VMware ESXi and vSphere Cluster Management

Server Information: How to Identify, Inspect, and Document Servers

Learn what server information to collect, how to inspect Linux and Windows systems safely, document inventories, and troubleshoot performance, connectivity, storage, and reboot problems.

Server information is the collection of technical, operational, and ownership details needed to identify, manage, secure, and troubleshoot a server. A server may be a physical computer, a virtual machine, a container, or a cloud instance. The term can also describe a software role, such as a web server or database server.

A useful server profile connects several views of the same system: the machine or virtual infrastructure, operating system, network, hosted services, applications, dependencies, security controls, owners, and support responsibilities. Accurate information helps teams perform maintenance, respond to incidents, plan capacity, meet compliance obligations, and hand systems over without losing essential knowledge.

What Server Information Includes

Server information is broader than a hostname or IP address. Separate the record into categories so that an administrator can understand both what the server is and what it does.

• Machine or infrastructure: hardware, virtual-machine identifiers, cloud instance metadata, CPU, memory, storage, and health.
• Operating system: family, distribution or edition, version, kernel or build, architecture, uptime, time zone, and update status.
• Network: addresses, prefixes, gateways, DNS resolvers, routes, listening ports, firewall rules, and remote-access paths.
• Services and applications: running services, roles, versions, configuration locations, process managers, endpoints, health checks, and logs.
• Security posture: administrator access, authentication, multifactor authentication, patching, encryption, certificates, endpoint protection, and backups.
• Ownership and operations: environment, business owner, technical owner, support team, criticality, monitoring identifier, and change history.

Server Identity and Inventory

A hostname is the human-readable name assigned to a server. An FQDN, or fully qualified domain name, is the complete DNS name for a host, such as app01.example.test. Record both when available, because a short hostname may be unique only within one network.

Also record the asset tag and serial number for physical equipment; the virtual-machine identifier for a VM; and the cloud instance identifier, account or project, region, and tags for a cloud server. Classify the system as physical, virtual, containerized, or cloud-hosted. A container is an isolated application environment that shares the host kernel, so its inventory must identify both the container and its host or orchestrator.

Operational labels provide context. Record whether the system is development, test, staging, or production; identify the business owner, technical owner, support team, and service criticality; and note maintenance windows and escalation contacts.

Operating System and Platform Details

Record the operating system family, distribution or edition, version, kernel or build number, and architecture. The kernel is the central part of an operating system that manages hardware and system resources. Architecture, such as 64-bit x86 or ARM, affects application and package compatibility.

• Time: uptime, boot time, time zone, and whether the system clock synchronizes with a trusted time source.
• Platform: hypervisor or virtualization platform, container runtime, cloud provider, account, region, image, and instance size where applicable.
• Software state: installed packages, update or patch status, repositories, and lifecycle or support status.
• Lifecycle: end-of-support dates, upgrade plans, and exceptions approved by the responsible team.

Uptime is the length of time since the server last booted. It helps correlate a problem with a reboot, update, deployment, or unexpected restart, but it is not by itself a health measurement.

Hardware and Resource Information

Resource information describes available capacity and current demand. A process is a running program instance. CPU utilization shows processor use at a point in time, while CPU load commonly represents demand for processor time over intervals on Unix-like systems. Interpret load together with core count, process activity, and the normal baseline.

• CPU: model, architecture, core and thread count, utilization, load, and high-consuming processes.
• Memory: RAM capacity, available memory, cache, current consumption, and swap or paging use. RAM is volatile memory used by running processes; swap is disk-backed memory used when RAM is under pressure.
• Storage: devices, partitions, volumes, filesystems, mount points, capacity, free space, inodes where relevant, and I/O activity. A filesystem organizes files on a disk or volume, and a mount point is the directory through which it becomes available.
• Network hardware: interface names, link state, assigned addresses, speed, errors, and throughput.
• Health: storage health, temperature, fan, battery, and power indicators when the platform exposes them.

Network and Connectivity Information

An IP address identifies a host for network communication. Record addresses, subnet masks or prefixes, default gateways, DNS resolvers, routes, and whether each address is public or private. DNS, the Domain Name System, translates names into IP addresses, so name resolution must be checked separately from routing and service availability.

A port is a numbered network endpoint associated with a service or process. Record expected listening ports, actual listening sockets, active connections, and the processes that own them. A firewall allows or blocks traffic according to rules. Include host firewall policies, cloud security groups, network ACLs, load balancer rules, and other controls that affect reachability.

Document approved remote administration methods, such as SSH, Remote Desktop, a cloud management console, or an out-of-band management system. Keep detailed internal addresses, routes, and administrative entry points restricted to people who need them.

Hosted Services and Applications

A service is a long-running background process that provides a system or network function. On Unix-like systems, such a process is often called a daemon. Record service names, enabled and running state, startup behavior, service account, process manager, configuration path, logs, and health-check endpoint.

Identify the server's roles, such as web, database, file, mail, directory, proxy, cache, or application server. For applications, record application and runtime versions, deployment method, configuration locations, endpoints, monitoring identifiers, and release information. Do not copy secrets from configuration files into the inventory.

Map dependencies between services, databases, storage, DNS, certificates, queues, identity systems, and external APIs. A web application can be running correctly while still failing because it cannot resolve a database name, reach a dependency, read storage, or use an expired certificate.

Security and Access Information

List authorized administrator groups and accounts by role rather than publishing unnecessary personal details. Apply least privilege: each person, service, and automation identity should receive only the permissions required for its task. Record authentication mechanisms, SSH key or certificate management, multifactor authentication, privileged-access workflows, and emergency access procedures without recording private key material or credentials.

• Patch and vulnerability status, including exceptions and remediation dates.
• Endpoint protection or host intrusion monitoring status.
• Encryption at rest and in transit, certificate subjects, issuers, and expiration dates.
• Backup policy, last successful backup, retention, and restoration test status.
• Audit logging, log retention, alerting, and monitoring coverage.

Restrict sensitive records using access controls, approved repositories, encryption, and audit trails. Replace real addresses, account names, serial numbers, identifiers, and endpoints with placeholders in training material or broad communications.

Collecting Information Safely

Use local commands, remote administration tools, cloud dashboards, monitoring platforms, and configuration-management inventories. Collect the operating system's view from inside the guest, then compare it with the virtualization or cloud platform's metadata. These views can differ: a cloud console may show an attached volume or public address that is not yet configured inside the guest.

Record the collection date and time, hostname or instance identifier, operator or access level, tool version where relevant, and whether the output was collected locally or remotely. Mark values as observed, configured, inherited, or unknown. Do not assume that a container has the same resource limits, network identity, or filesystem view as its host.

Linux inspection commands

# Identity and operating system
hostnamectl
cat /etc/os-release
uname -a
uptime

# CPU, memory, and storage
lscpu
free -h
df -h
lsblk
du -xh /path | sort -h

# Network and services
ip addr
ip route
resolvectl status
ss -tulpn
systemctl --type=service --state=running

# Recent warnings and one service's logs
journalctl -p warning..alert -b
journalctl -u service-name --since "1 hour ago"

These commands are intended for inspection. The du example should use a suitable path, and sorting a large tree can take time. Permission restrictions may cause incomplete results.

Windows PowerShell inspection commands

# Identity, operating system, and boot time
Get-ComputerInfo
hostname
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

# Hardware, storage, network, and services
Get-CimInstance Win32_Processor
Get-CimInstance Win32_PhysicalMemory
Get-Volume
Get-NetIPAddress
Get-NetTCPConnection -State Listen
Get-Service | Where-Object Status -eq 'Running'

# Recent system and application events
Get-WinEvent -LogName System -MaxEvents 50
Get-WinEvent -LogName Application -MaxEvents 50

PowerShell output can be large. Select only the properties needed for the server profile, and sanitize names, addresses, identifiers, and event details before sharing.

Common Commands by Platform

Server Information Inventory Template

Interpreting and Maintaining the Record

Raw command output is evidence, not a finished profile. Translate it into stable facts and operational meaning. For example, turn a disk listing into filesystem, size, used percentage, free space, mount point, growth rate, and owner. Turn a list of ports into expected service, process owner, exposure, and monitoring coverage.

Establish a baseline, which is a recorded normal state used for comparison. Baselines should include normal CPU load, memory and swap use, disk free space, I/O, network throughput, listening ports, service state, and log volume. A value is concerning when it differs from the system's expected behavior, not merely because it is nonzero.

Keep the record current through change management, scheduled verification, automated discovery, monitoring integration, and configuration-management inventories. Recheck ownership, addresses, certificates, versions, backups, and dependencies after migrations, deployments, resizing, and role changes. An asset inventory is a maintained record of computing resources and their attributes; it should have an owner and a defined review interval.

Troubleshooting with Server Information

Start with identity, uptime, resource consumption, logs, network state, and service status. Compare current observations with the baseline and with recent changes. Use a small set of relevant facts when escalating: affected host, time range and time zone, symptom, expected behavior, observed values, sanitized errors, recent changes, and actions already taken.

Practical Example: Linux Server Profile

Suppose a read-only collection produces the following sanitized summary: hostname web01.example.test; Linux distribution version 9.x; kernel 6.x; uptime 42 days; 4 CPU cores; 16 GiB RAM; root filesystem 62% used; private address 10.0.10.20; running web and monitoring services; and an expected HTTPS listener.

The interpretation is that storage and memory appear normal only when compared with the established baseline. A root filesystem at 62% may be healthy if normal growth is slow and the alert threshold is 80%, but it deserves a trend check. Long uptime is not automatically a problem; check pending updates, maintenance policy, and whether recent changes require a controlled restart. Confirm that the HTTPS listener belongs to the expected process and is reachable through the intended firewall path.

Practical Example: Windows Server Profile

A concise Windows inventory entry might include computer name APP-WIN-01; Windows Server edition and build; last boot time; processor model and logical processor count; installed memory; volume sizes and free space; IP configuration; installed roles; running services; active firewall profiles; monitoring identifier; backup result; owner; and criticality.

Keep the entry operational rather than copying every property returned by Get-ComputerInfo. Link to approved event-log searches and configuration records, but exclude credentials, private keys, access tokens, and unrestricted exports containing sensitive network or user information.

Practical Example: Cloud Virtual Machine

For a cloud VM, record the cloud account or project, region, instance ID, image, instance size, private and public addresses, attached volumes, security groups, backup policy, tags, owner, and environment. Then record the guest operating system's hostname, interfaces, routes, mounted filesystems, services, and local firewall state.

Cloud-console metadata and guest-visible data answer different questions. The console may show an assigned public address, instance profile, volume attachment, or security group; the guest may show only private interfaces, a different hostname, or a filesystem that has not been mounted. Record relationships between these layers so an operator knows where to investigate.

Information Classification

Exam-Relevant Notes

• Hostname identifies a server for people and systems; an IP address identifies a network location; DNS maps names to addresses.
• Uptime indicates time since boot, not overall health.
• RAM is physical volatile memory; swap is disk-backed memory and active swap can indicate memory pressure.
• A listening port proves that a process has opened a socket, not that the service is reachable through every firewall or route.
• A virtual machine has a guest operating system, while the hypervisor or cloud platform supplies another management layer.
• A container shares the host kernel, so container information must be interpreted together with host and orchestrator information.
• Use baselines and recent changes to interpret CPU, memory, disk, network, and service measurements.
• Documentation should be useful, current, access-controlled, and free of credentials and private key material.

Summary

A complete server profile identifies what the system is, where it runs, who owns it, what it provides, how it connects, how it is secured, and how its condition compares with normal behavior. Collect identity, platform, resources, network, services, dependencies, security, monitoring, and backup details with read-only tools first. Document collection time and access context, sanitize sensitive values, maintain baselines, and update records through change management and automated discovery.

Use the server information reference as the starting point for an inventory that supports administration, troubleshooting, capacity planning, incident response, compliance, and reliable operational handoffs.