VMware

This Question is Possibly Answered

1 "correct" answer available (10 pts) 2 "helpful" answers available (6 pts)
6 Replies Last post: Jan 29, 2009 9:13 AM by Texiwill  

What are your top 10 critical log events you check for in the logs? posted: Jan 28, 2009 9:19 AM

Click to view sbeaver's profile Guru 7,719 posts since
Nov 1, 2004

Hey guys I have a question for you all for something I am working on so please if you have time reply

What are the top 10 critical log events you check the logs for?


Steve Beaver
VMware Communities User Moderator
====
Co-Author of "VMware ESX Essentials in the Virtual Data Center"
(ISBN:1420070274) from Auerbach
Come check out my blog: http://www.thevirtualblackhole.com/

**Virtualization is a journey, not a project.**

Click to view jasonboche's profile Champion 5,896 posts since
Jan 7, 2004
I couldn't come up with a list of 10 if I tried.

The main one is SCSI communication issues (timeouts during snapshot closures, etc.).
Occasionally I can be found looking at VirtualCenter logs sleuthing VMUM database connection errors

This is to say our VI mostly runs like a top.






Jason Boche
boche.net - VMware Virtualization Evangelist
VMware Communities User Moderator
Minneapolis Area VMware User Group Leader

Click to view Jasemccarty's profile Champion 3,806 posts since
Apr 5, 2005

I'm going to have to agree with Jas on this one.

CPU, Memory, Heartbeats, Hosts down, etc can all be alerted through either vCenter, or other methods.

Things like data timeouts, slowness, etc, are things we need to look at regularly. The SAN may not indicate to us that it sees anything wrong, but VI3 might have issues that the SAN doesn't care about.

Jase

Jase McCarty
http://www.jasemccarty.com
Co-Author of VMware ESX Essentials in the Virtual Data Center
(ISBN:1420070274) from Auerbach
Please consider awarding points if this post was helpful or correct

Click to view Lightbulb's profile Virtuoso 1,391 posts since
Aug 15, 2008
esx sshd(pam_unix)3023: session opened for user root by (uid=0) :)
Click to view Lightbulb's profile Virtuoso 1,391 posts since
Aug 15, 2008
My previous post was meant as sort of a joke, but in truth when I come against a "How did that happen" kind of issue as often as not human error is involved. A system/cluster/network that has been working fine and suddenly goes south is usually caused by a hardware failure or human action and human action edges out hardware failure by a fair margin.

Even performance degradation issues can be tracked to admin actions.

So from a troubleshooting standpoint who last logged onto the system(s) in an admin capacity is something to look for in the logs.

From a pure monitoring standpoint the security implications of who is accessing the systems is also worthy of note.
Click to view RParker's profile Champion 5,270 posts since
Dec 6, 2006

I only check vmkernel to ensure there aren't any glaring errors. Otherwise I use alerts. I figure if it's serious enough it should trigger an alert at some point.

Otherwise I agree with Jason also, there isn't a top 10, maybe only 1 or 2.

Click to view Texiwill's profile Guru 10,212 posts since
Jan 13, 2004
Hello,

Root sessions
SCSI Errors
SCSI Reservations
CPU issues
vmhba issues


Best regards,
Edward L. Haletky
VMware Communities User Moderator
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.
Blue Gears and SearchVMware Pro Blogs
Top Virtualization Security Links

VMware Developer

SDKs, APIs, Videos, Learn and much more in the Developer community.

Learn More

Developer Sample Code

Increase your developer productivity with VMware API sample code.

Learn More

VMworld Sessions & Labs

Online access to the latest VMworld Sessions & Labs and online services.

Learn more

Purchase PSO Credits Online

Purchase credits to redeem training and consulting services online.

Buy Now

Community Hardware Software

View reported configurations or report your own.

Learn More

VMware vSphere

Come witness the next giant leap in virtualization.

Register Today

Communities