lsdoctor (Lookup Service Doctor, lsdoctor.py) is Broadcom’s script for checking and repairing the vCenter Lookup Service: stale registrations, SSL trust mismatches, solution users and broken service registrations. The current build is lsdoctor-260716 (July 2026) and it supports vCenter 6.7 and later, including 7.x, 8.x and 9.x. Download it only from Broadcom KB 320837, take offline snapshots of every node in the SSO domain, and always start with the read-only --lscheck.
If the problem is an expired or mismatched certificate rather than the Lookup Service itself, check and replace certificates with vCert first.
lsdoctor at a glance
| Current build | lsdoctor-260716.zip, added 16 Jul 2026 (always take the latest attachment from KB 320837) |
| Supported | vCenter Server 6.7 and later, VCSA or Windows-based, including 7.x, 8.x and 9.x. Support for the newest builds can lag behind a vCenter release. |
| Download | Only from Broadcom KB 320837. Verify the SHA256 listed in the KB. |
| Where to run it | Most options run on any node in the same SSO site as the affected node. --stalefix and --solutionusers run on the affected node itself. |
| Output | Findings per node, shown as SSO site plus hostname/PNID, and the path to a JSON report |
| Safe first step | --lscheck makes no changes |
Before you run lsdoctor
- Take offline snapshots of the whole SSO domain. KB 320837 is explicit: shut down all vCenter Servers and PSCs in the SSO domain at the same time, snapshot them, then power them on again. If you need to roll back, shut them all down and revert them together, otherwise replication between nodes breaks.
- Pick the right node. Run checks from a node in the same SSO site as the one with the problem. For
--stalefixand--solutionusers, log in to the affected node. - Check for a custom login banner. lsdoctor reads the vCenter version from
/etc/issue. A custom banner makes it fail withIndexError: list index out of range(see fixing lsdoctor’s IndexError on 8.0.3). - Plan for follow-up work. Every option except
--lscheckends with a service restart, and most require re-registering external solutions such as backup, storage or monitoring plugins.
Download and install lsdoctor
Download the zip from KB 320837 and copy it to the node, for example with WinSCP. If WinSCP can’t connect to the appliance, set root’s login shell to bash first (chsh -s /bin/bash root). On the VCSA:
# cd /root
# sha256sum lsdoctor-260716.zip # compare with the SHA256 in KB 320837
# unzip lsdoctor-260716.zip
# cd lsdoctor-*
# python lsdoctor.py --helpAlways run lsdoctor from the extracted directory. On a Windows-based vCenter 6.7, extract the zip with Extract All, then run it with the bundled Python:
cd "C:\Program Files\VMware\vCenter Server\python"
.\python.exe <path_to_lsdoctor.py> <option>lsdoctor options
| Option | What it does | Run on | Follow-up |
|---|---|---|---|
-l, --lscheck | Checks for common Lookup Service issues. Makes no changes. | Any node in the SSO site | Review the output and the JSON report; it tells you which fix applies |
-t, --trustfix | Corrects SSL trust mismatches in the Lookup Service | Any node in the SSO site | Restart services on all nodes in the SSO site; re-register external solutions |
-s, --stalefix | Cleans up stale configuration left over from systems upgraded from 5.x | The affected node | Restart all services; re-register external solutions |
-u, --solutionusers | Recreates the solution users for a node | The affected node | Restart services on that node |
-r, --rebuild | Rebuilds one or all service registrations for a node | Any node in the SSO site | Restart services; re-register external solutions |
-p, --pscHaUnconfigure | Removes a PSC High Availability (load balancer) configuration | See KB 320837 | Restart services on all PSCs; repoint vCenter; re-register external solutions |
--rebuild uses registration templates that match your vCenter build. If lsdoctor has no template for your exact build, it asks you to pick the closest one. It also keeps automatic backups of the registrations it changes, and the same menu can restore them.
Which lsdoctor option for which problem
| What you see | Start with | Then |
|---|---|---|
| Upgrade, patch or repoint pre-checks fail with Lookup Service or registration errors | --lscheck | The fix it recommends (usually --trustfix, --stalefix or --rebuild) |
| Plugins or solutions fail after replacing the Machine SSL certificate; certificate mismatch in Lookup Service registrations | --lscheck | --trustfix, or vCert option 4 (Manage SSL trust anchors) |
| Leftover registrations from a vCenter upgraded from 5.x | --lscheck | --stalefix on the affected node |
| Solution user errors on one node | --lscheck | --solutionusers on that node |
| Missing or broken service registrations | --lscheck | --rebuild |
| Retiring a PSC HA load balancer | – | --pscHaUnconfigure, then repoint vCenter |
lsdoctor itself fails with IndexError: list index out of range | Check /etc/issue | Restore the default banner temporarily |
lsdoctor vs vCert
| Tool | Fixes | Use it when |
|---|---|---|
| lsdoctor | Lookup Service data: registrations, trust in registrations, solution users, stale entries | Services can’t find or trust each other, or upgrades fail on registration checks |
| vCert | The certificates themselves: Machine SSL, Solution Users, STS, VMCA, ESXi, trust anchors | Certificates are expired, expiring or replaced, or you see no healthy upstream after an expiry |
The two overlap on trust anchors. A common sequence is: fix the certificates with vCert, then run lsdoctor --lscheck to confirm the Lookup Service registrations trust the new certificate.
Related vCenter guides
- vCert: check and fix vCenter certificates with vCert.py
- Fixing lsdoctor’s IndexError on vCenter 8.0.3
- vCenter STS signing certificate expiration: small certificate, big outage
Full reference: Broadcom KB 320837 – Using the lsdoctor tool.
