Event Logging Issue

[Khue]

I have a pretty nasty logging issue that is crushing my VCDB. I am currently seeing a log in and log out event on every one of my servers in my environment every minute. I have 10 servers and one VC. I have my database retention turned way down to 60 days for both tasks and events however, the SQL 2005 Express installation is still nearing the 4 gig limitation. When I browse the database the log in and log out events account for a majority of the VCDB's size. I have 2 questions:

1. Is this normal behavior? Does everyone see constant login and log offs every minute, on every server?
2. Is there a way to filter the event (logon and log off) from a certain client?

Any other troubleshooting suggestions anyone can make are welcome and appreciated.

Thanks in advance!

[Masl]

Hello Khue,

I experience exactly the same isses atm.

For the moment I changed some "vCenter Server Settings"

1)     "Statistics", disable all

2)     "Logging Options" to Warning (Errors and warnings)

3)     "Database Retention Time" 1 day only for tasks & events

From SQL Mgmt Studio & services.msc:

1)     backup VIM_VCDB

2)     run the stored procedure "cleanup_events_tasks_proc" (Programmability --> Stored Procedures)

3)     stopped the following services: VMware VirtualCenter Server [dependency --> VMware VirtualCenter Management Webservices]

4)     run VCDB_table_cleanup_MSSQL_V4.X.sql from "Purge old data from vCenter 4.x Database" (CUTOFF_DATE -1)

5)     shrink database

6)     backup VIM_VCDB

7)     start the following services: VMware VirtualCenter Server [dependency --> VMware VirtualCenter Management Webservices]

I know this is no solution to the primary problem, but it gives time to investigate and it's - hopefully - a humble guide for anyone who's DB is about to reach the 4GB limit.

I'll keep you posted, in case I stumble across a solution.

btw: iirc, your enironment is beyond the recommendend size for SQL2005EE.

Mine isn't but I have the same problems...I also consider to migrate to SQL2008 (R2) becasue of the DB limit of 10GB.

Best regards,

Masl

[Khue]

The biggest issue I have is that my company is not willing to purchase a copy of SQL server standard for the virtual center when realistically we need it. I do realize that my environment is beyond the recommended settings for SQL Express. I have also since convinced the network admin to do all snmp polling through the virtual center instead of per esx server. Hopefully this will cut down on the amount of logging we will do. I am keeping a close eye on the database meanwhile. Thanks for your suggestions.

[Masl]

I had exactly the same issue and it was the reason for my enormous DB growth.

Here is my thread, containing the solution for my problen

--> http://communities.vmware.com/message/1734845

...check what rows (from VIM_VCDB) are growing that fast by executing the following statement from SQL Mgmt Studio.

(found this on the www)

SELECT

sysobj.name as [Table Name] , MAX(sysidx.rows) as [Row Count]

FROM

sysobjects sysobj, sysindexes sysidx

WHERE

sysobj.xtype = 'U'AND sysidx.id = OBJECT_ID(sysobj.name)

GROUP

BY sysobj.name

ORDER

BY 1

If it's the tabels: vpx_event and/or vpx_event_arg look into them.

with

select * from vpx_event and select * from vpx_event_arg

If you see lots of rows containing entries like:

Table VPX_EVENT

     EVENT_TYPE                                  USERNAME

     vim.event.UserLoginSessionEvent      Evil-User-Name

Table VPX_EVENT_ARG

     ARG_DATA

     Evil-IP-Address

Then you should have the source IP and the account that tries to login into vCenter.

That's how I discovered what's filling my DB.

I hope that'll help.

If so then your DB shouldn't grow rapidly and you don't have buy/install full SQL.

Best regards,

Masl

[nstreb]

I ran into the same kind of issue with login/logout events.  It turned out to be my network monitoring running health checks all the time and logging in.  Not really something I want to turn off so I just set the loggging level to warning/error only.