Configuring event monitoring

This section provides information about performing operations on event filters.

Configuring event monitoring

PATROL for VMware vSphere enables you to create filters that monitor events in the vCenter server for a specific object based on event properties. You can filter events by: 

  1. Managed object - You can monitor events for a specific managed object (such as Datacenter, ESX server, virtual machine, and cluster) as well as its child objects (if any).
  2. Event severity - You can monitor events with the following types of severity:
    • Information - Displays the number of information events matched for a managed object.
    • Error - Displays the number of error events matched for a managed object.
    • User - Displays the number of user events matched for a managed object.
    • Warning - Displays the number of warning events matched for a managed object. By default, events are monitored for all the severity types.
  3. Event type - You can monitor various types of events, such as VmConnectedEvent and VmPoweredOffEvent. By default, all event types are monitored. For more information about types of events, see VMware documentation.
  4. User - You can monitor events for a specific user who triggered those events. By default, events for all the users are monitored.

Creating or modifying event filters

  1. On the Add Monitoring Configuration page, in the vCenter/ESX Server Details section, click Add.
  2. In the Event Monitoring Configuration section, in the Event Filtering Details field, click Add.
  3. In the Filter Name field, enter a unique filter name.
  4. In the Filter Description field, enter any significant information that you would like to store about the filter. 
  5. From the Managed Object Type list,select the type of the managed object for which you want to monitor the events.
    The following managed objects are available.
    • Datacenter
    • HostSystem
    • VirtualMachine
    • ClusterComputeResource
    • ResourcePool
    • Datastore
    • Folder
    • Other Type 

  6. In the Managed Object Name field, if you selected any one of the managed object type (except Other Type) from the Managed Object Type list, enter the managed object name as it appears in the vCenter.
    If you selected Other Type in the Managed Object Type field, enter the type and ID of the managed object in the following format - ManagedObjectID|ManagedObjectType. For example, to create a filter for a network object with a managed object ID of network-19, enter network-19|Network in the Managed Object Name field. You can find the managed object type and ID in the Managed Object browser of vCenter. 
  7. Select the Monitor Events of Child Entities of this Object check box to monitor events of all the child instances of the selected managed object name.
    For example, if you want to monitor all events for a Datacenter and all its related entities, select this check box and ensure that you have selected Datacenter in the Manged Object Type list.
  8. From the Event Severity list, select one or more event severity by which you want to filter events for the selected managed object type. 
  9. The following severity values are available for monitoring:
    1. Information
    2. Warning
    3. Error
    4. User
  10. In the Event Type field, enter a comma-separated list of VMware vSphere available event types (VMware event data objects) by which you want to filter events for the selected managed object type.
    If you do not specify an event type, all event types are monitored by default.
    For example (VMware event data objects): VmConnectedEvent,VmPoweredOffEvent,VmPoweredOnEvent,DrsVmMigratedEvent
  11. In the Event User field, enter a comma-separated list of users by which you want to filter events for the selected managed object type.
    If you do not specify a user, events for all the users are monitored by default. 
  12. Select the Monitor System Generated Events check box to monitor system-generated events along with the user-generated events.

Deleting event filters

  1. Right-click the vCenter node for the VSM_VC application class and then select KM Commands > Configure Event Monitoring > Delete Filter.
  2. On the Delete Filter dialog box, select the names of the filters that you want to delete from the list displayed and then click Apply.

Acknowledging events

When you create filters for event monitoring, depending on the filter criteria you have specified, following parameters are created under the Events folder of the managed object:

  1. Error
  2. User
  3. Warning
  4. Information

You can acknowledge these parameters whenever they go into warning or alarm state. After you acknowledge these parameters, they go into OK state. To acknowledge event filtering parameters, right-click the created filter under the managed object for which you have created event filters, and select KM Commands > Acknowledge.

Turning annotations on or off for event filtering parameters

You can turn the annotation on or off for the event filtering parameters. When you turn the annotations off for these parameters, annotation report is not available for these parameters. 
To turn the annotations on or off for the event filtering parameters, right-click the Events folder for the managed object, and then select KM Commands > Annotations > On, or KM Commands > Annotations > Off. 
You can also use the eventAnnotation agent configuration variable to turn the annotation on or off for the event filtering parameters. For more information about using this variable, see eventAnnotation. 

BMC offers several PATROL consoles from which you can view a PATROL Knowledge Module (KM). Because of the different environments in which these consoles run, each one uses a different method to display and access information in the KM. This appendix provides instructions for accessing the KM menu commands, InfoBoxes, and online Help on each of the PATROL consoles. 

For more detailed information about navigation in the PATROL consoles, see the online Help for the BMC PATROL product for VMware vSphere.

Custom events

The following are the set of custom events that are used for event monitoring configuration, by default these events are disabled:

  • MEMORY_SIZE_CHANGED
    vCenter=<vCenterName> Host=<ESXi name> VM=<VM name> Memory Size has been reconfigured from <previous value> to <new value>
  • CPU_NUM_CHANGED
    vCenter=<vCenterName> Host=<ESXi name> VM=<VM name> CPU number is changed from %s to %s
  • DISK_SIZE_CHANGED
    vCenter=<vCenterName> Host=<ESXi name> VM=<VM name> DISK=<Disk name> Previous_size=<previous value> Current_size=<new value>
  • NEW_DISK_ADDED
    vCenter=<vCenterName> Host=<ESXi name> VM=<VM name> DISK=<Disk name> size=<value>
  • HOSTFAILED
    A possible host failure has been detected by HA on Host=<ESXi name> in Cluster=<Cluster name> in vCenter=<vCenter name>
  • RELOCATION
    VM=<VM name> Relocation completed successfully fromHost=<ESXi name> toHost=<ESXi name> in Cluster=<Clsuter name> in vCenter=<vCenter name>
  • DRSVMMIGRATION
    VM=<VM name> DRS Migration completed successfully fromHost=<ESXi name> toHost=<ESXi name> in Cluster=<Clsuter name> in vCenter=<vCenter name>
  • MIGRATION
    VM=<VM name> Migration completed successfully fromHost=<ESXi name> toHost=<ESXi name> in Cluster=<Cluster name> in vCenter=<vCenter name>
  • Host CPU utilization events
    Processor total utilization <value> for <ESXi name>(physical host) in <vCenter name>(vCenter) exceeds the warn level
    Processor total utilization <value> for <ESXi name>(physical host) in <vCenter name>(vCenter) exceeds the alarm level
  • VM CPU utilization events
    Processor total utilization <value> for <VM name>(virtual machine) located at <ESXi name>(physical host) in <vCenter name>(vCenter) exceeds the warn level
    Processor total utilization <value> for <VM name>(virtual machine) located at <ESXi name>(physical host) in <vCenter name>(vCenter) exceeds the alarm level

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*