"Hardware polling failed: Polling of chassis (CIM_Chassis class) failed. Unable to establish session with all provided credentials." when polling for hardware health with VMware ESX / ESXi 8

Authorization of entities within the environment is crucial for securing the network against unauthorized access of the entities. Any attempt leads to a warning/error messages shown on the Hardware Details page such as “Hardware polling failed: Polling of chassis (CIM_Chassis class) failed. Unable to establish session with all provided credentials”.

See an example of a failed authorization response:

Enter host password for user 'dummyuser': 
HTTP/1.1 401 Unauthorized 
WWW-Authenticate: Basic realm="cimom" 
Server: sfcHttpd 
Content-Length: 0 

On ESXi hosts running VMware 8, the CIM server may be disabled for security reasons. To access hardware health monitoring data, the CIM server must be enabled. However, VMware currently recommends keeping the CIM server disabled and has announced plans to deprecate this feature in a future release. 

This issue is caused by the hardware monitoring data not being accessible because the CIM server is possibly disabled on the ESXi host. 

As a short-term solution for hardware health monitoring data, please enable the CIM Server.

To be able to execute commands directly on the ESXi server(s), make sure that you are able connect to the ESXi server using SSH. 

1. Log in to the vSphere User Interface (using the browser and the IP address of the ESXi server)
2. Go to Manage > Services.
3. Scroll down until you see the "TSM-SSH" service on the list.
4. Select the TSM-SSH service 
5. Click Start. 

You can use your PowerShell or a SSH client, such as PuTTY, to connect to the IP of the ESXi server. Use the "root" user and your password (the same password as the one used to log in to the UI). Replace the <host_ip> with the correct IP address of your machine.

PS C:\Users\user> ssh <host_ip> -l root 
The authenticity of host '<host_ip> (<host_ip>)' can't be established. ECDSA key fingerprint is SHA256:FVX5WJiyiTMzXO+2irzSxItA23n9f65jKnZW66V5L9M.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '<host_ip>' (ECDSA) to the list of known hosts.
Password:
The time and date of this login have been sent to the system logs.

WARNING:
   All commands run on the ESXi shell are logged and may be included in
   support bundles. Do not provide passwords directly on the command line.
   Most tools can prompt for secrets or accept them from standard input.

VMware offers supported, powerful system administration tools.  Please
see www.VMware.com/go/sysadmintools for details.

The ESXi Shell can be disabled by an administrative user. See the
vSphere Security documentation for more information.
[root@mon-vman-nested-esxi8-latest-03:~] 

Start the sfcbd-watchdog service:

[root@mon-vman-nested-esxi8-latest-03:~] /etc/init.d/sfcbd-watchdog start
sfcbd-init[3887119]: args ('start')
sfcbd-init[3887119]: Getting Exclusive access, please wait...
sfcbd-init[3887119]: Exclusive access granted.
sfcbd-init[3887119]: Request to start sfcbd-watchdog, pid 3887119 
sfcbd-init[3887119]: sfcbd not started, administratively disabled.  

To enable the sfcbd-watchdog service, first enable the "wbem" service using esxcli:

[root@mon-vman-nested-esxi8-latest-03:~] esxcli system wbem set -e true

To verify the current settings of this service, view the details:

[root@mon-vman-nested-esxi8-latest-03:~] esxcli system wbem get
Enabled: true
WS-Management Service: true
Enable HTTPS: true
Authorization Model: password
Port: 5989
HTTP Procs: 2
HTTPS Procs: 4
Provider Procs: 16
Keepalive Timeout: 1
Keepalive Max Requests: 10
Provider Sample Interval: 30
Provider Timeout Interval: 120
HTTP Max Content Length: 1048576   
Max Message Length: 40000000
Thread Stack Size: 1048576
Provider Resource Pool Override:
SSL Cipher List: ECDHE+AESGCM:ECDHE+AES
Threadpool Size: 5
Readonly: false
Log Level: warning
Service Location Protocol PID: 0
WS-Management PID: 3887350
CIM Object Manager PID: 3887350
Enabled SSL Protocols:
Enabled System SSL Protocols: tlsv1.2
Enabled Running SSL Protocols: tlsv1.2

Enabled is now set to true.

Communication with the CIM server

Enabling the "wbem" service automatically starts the sfcbd-watchdog service:

[root@mon-vman-nested-esxi8-latest-03:~] /etc/init.d/sfcbd-watchdog status 
sfcbd-init[3887350]: args ('status')
sfcbd-init[3887350]: Getting Exclusive access, please wait...
sfcbd-init[3887350]: Exclusive access granted.
sfcbd is running

If the service has not been started, you can either start the service in the vSphere UI or in the command line:

[root@mon-vman-nested-esxi8-latest-03:~] /etc/init.d/sfcbd-watchdog start

You can close the connection and open another PowerShell window to communicate with the CIM server using tcp/5989.

Make sure to disable the SSH service once the CIM Server has been enabled.

Check the polling

Some features may be blocked for the domain account. Make sure to use your local account (for example, the root user).

Test the HWH polling authorization via command line (CIM server must be running on the host):

PS C:\Users\user> curl -ik 'https://<host_ip>:5989' --request POST --data "" --basic --user <host_user>

Replace the <host_ip> and <host_user> with the correct IP of the host and the correct user.