vCenter inventory, produced with care.

Red Hat audit teams ask for VMware vCenter inventory because vCenter is the source of truth for virtualisation topology and because Red Hat's virtual datacenter and socket pair entitlement models depend on host level counts. The audit team's opening evidence request frequently asks for a full vCenter export across the entire estate. RVTools, the third party utility that produces a structured Excel report from vCenter, is the most common format the audit team will name. The defended response treats the request seriously and produces evidence the contract entitles the audit team to see, but does not produce more than the contract requires.1

The practice's reading is that the opening RVTools request is materially broader than the audit clause typically permits. RVTools dumps the entire vCenter inventory, including hosts that do not run RHEL, clusters that do not host any Red Hat workload, and virtual machines that are out of scope. The defended production filters the RVTools output to the subset of hosts that actually run RHEL workloads, with the filter logic documented and the filtered fields reasoned. The parent service note on Red Hat audit defense treats the general evidence posture; the present note treats the vCenter specific application.

The RVTools workbook has roughly thirty tabs and several hundred fields. The audit team needs perhaps a dozen fields. Host name, cluster membership, CPU socket count, CPU core count, hyperthreading status, virtual machine count on the host, and the guest operating system of each virtual machine are the fields that the Red Hat entitlement count rests on. The remaining fields, including network configuration, datastore mapping, snapshot ages, and resource pool detail, are not required for entitlement counting and do not need to leave the production environment.

The defended response produces a curated workbook with the entitlement relevant fields and a clear caption explaining the production scope. The audit team that asks for additional fields must justify why; the defended response treats each additional field on its merits. The companion note on RHEL socket pair vs virtual datacenter counting treats the mechanics that the vCenter fields feed into.

The contractual scope question precedes the technical export question. The audit clause governs which workloads the audit team is entitled to see; the vCenter export must be filtered to that scope before production. Hosts in clusters that do not run RHEL are out of scope. Virtual machines running operating systems other than RHEL are out of scope for RHEL audit purposes. Hosts running RHEL Developer subscriptions are typically in scope but with different counting rules than production RHEL.

The defended response builds the scope filter first and applies it to the raw vCenter export second. The filter logic is documented in a memorandum that accompanies the production. The audit team's challenge to the filter must be addressed on the merits; the defended response anticipates the obvious challenges (mixed RHEL and Windows clusters, in particular) and pre answers them in the memorandum. The companion note on audit clause anatomy and negotiation treats the contractual scope side.

RHEL virtual datacenter entitlements cover unlimited RHEL guests on the hosts the entitlement assigns. The audit team's opening position frequently treats every host in a vCenter as a candidate for VDC counting, regardless of whether the host actually carries a VDC entitlement. The defended production identifies which hosts are VDC entitled and which are entitled by other models (socket pair, individual subscription, RHEL on a hypervisor variant). The host level entitlement map is the evidence the audit team needs; the raw vCenter dump is not.

VDC counting interacts with DRS, vMotion, and cluster topology. The audit team that asks about vMotion patterns is asking a relevant question; the defended response provides the cluster configuration and the DRS rule set, but does not need to provide the full event history. The companion note on RHEL virtual datacenter deep dive treats the counting mechanics in depth.

The defended production is a curated Excel workbook with the entitlement relevant fields, accompanied by a memorandum that explains the scope filter, the field selection, and the entitlement map. The memorandum is the most important document in the production; the audit team that reads only the spreadsheet without the memorandum will frequently misinterpret the data, and the memorandum corrects the misinterpretation in advance.

The production is marked confidential and exchanged through a secure channel agreed with the audit team. Productions sent over plain email or uploaded to vendor portals without a confidentiality agreement frequently appear in subsequent audit communications in ways that surprise the customer. The companion note on audit document preservation protocol treats the disclosure mechanics that govern all productions.2

Customers replacing VMware with OpenShift Virtualization face a different evidence picture. The KubeVirt based platform exposes virtual machine inventory through Kubernetes resources rather than vCenter; the evidence flow differs. The cross link into Lane 11 on OpenShift edge deployment licensing treats one application of the platform. The audit posture on OpenShift Virtualization workloads is treated separately from VMware workloads and frequently produces a different entitlement map.

The practice begins vCenter evidence engagement by establishing the contractual scope, building the filter logic, curating the RVTools workbook, and drafting the accompanying memorandum. The defended production reaches the audit team as a coherent package with the entitlement map already drawn; the audit team then has to challenge the package rather than build its own map from scratch. The work front loads the analysis and frequently saves weeks in the back and forth. The parent practice note on RHEL licensing treats the product side that the vCenter evidence feeds into.

Across vCenter heavy audits in the practice's trailing twelve months, defenses that produced curated workbooks with memoranda settled at materially lower percentages of the initial Red Hat finding than defenses that produced raw RVTools dumps. If the audit notice asks for vCenter inventory, the first useful hour is a call with the desk to scope the production. The companion notes on KVM and Proxmox evidence and subscription manager output as evidence treat parallel evidence types; audit clause anatomy treats the contractual scope that wraps all evidence productions.

Preparing a response? The practice keeps a one-page Red Hat audit response checklist — what to acknowledge, what to preserve, and what not to volunteer in the first fourteen days after the letter arrives.