A few of my ESX servers are reporting the following error: "Cannot login rsa@logserver ip address" . The majority of the ESX servers are not reporting the issue.
Where exactly are you seeing these error messages? When you say you are seeing these on the ESX servers do you mean the error is in the ESX server Host logs or that you are seeing this in guest logs on the ESX server? Are you using Netwitness log collection to pull ESX logs from the ESX servers? The more details you can provide the better to get a clearer picture of what you are seeing.
This sounds like the username and password being used by Netwitness to collect the logs from these ESX servers is incorrect. Have the Netwitness administrator look at the log collectors that are collecting from these ESX servers and determine if the credentials being used are valid. It is possible that the account being used is a domain account who's password has expired or someone has changed the password but didn't realize that it needed updated on the Netwitness side to allow the user account to continue to pull logs from these ESX servers.
Give this a quick look and let me know what the results of your investigation are. We may need to see the /var/log/messages file from the log collector if the account credentials look good.
It is possible they are not all using the same set of credentials to collect logs from the ESX servers. This is why it is important to make sure by checking the log collectors to see if they are all in the same group, using the same credentials, or in different groups on the same log collector or on different log collectors (using different credentials).
