VMware Cloud Community
bramvermeulen
Contributor
Contributor

Alert: Report which user triggered the alert on a virtual machine

Greetings,

I'm trying to customize my alerting within vCenter/vSphere a bit and I've found that I can trigger alerts when a VM is powered off/rebooted or even when a console has been opened. I'd like to use these triggers but it should also report which user, for example, opened the console. At the moment all I get is a mail like this:

Target: testwlbsvm1

Previous Status: Gray

New Status: Red

Alarm Definition:

()

Event details:

Remote console connected to testwlbsvm1 on host esxi02

Is there a possibility (doesn't have to be with the notification e-mail action) to include the user opening the console or powering off the virtual machine in this report?

Thanks in advance,

Bram

Reply
0 Kudos
3 Replies
AndreTheGiant
Immortal
Immortal

I think that is not possible to customize the report from vCenter GUI.

You can check for a monitor script that make this.

Andre

Andre | http://about.me/amauro | http://vinfrastructure.it/ | @Andrea_Mauro
Reply
0 Kudos
AnatolyVilchins

So, have you solved your problem? How?

iSCSI Software Support Department

Kind Regards, Anatoly Vilchinsky
Reply
0 Kudos
bramvermeulen
Contributor
Contributor

I had actually forgotten about this, but come to think of it there's a way to do this. The "set" command has alot of info in it.

For example if you make an alert and run a command on vcenter that just write set to a txt file you get all the information you need, example:

content of a .bat file on vcenter that's executed by triggering the alarm:

echo set >> "c:\temp\test.txt"

output:

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\USERNAME\Application Data
CLIENTNAME=VIEW-XP01
ClusterLog=C:\WINDOWS\Cluster\cluster.log
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=VCENTERHOSTNAME
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
lib=C:\Program Files\SQLXML 4.0\bin\
LOGONSERVER=\\DOMAINCONTROLLER
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Intel\DMIX;C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\;C:\WINDOWS\system32\WindowsPowerShell\v1.0
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=EM64T Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\
SESSIONNAME=RDP-Tcp#3
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\VCUSER\LOCALS~1\Temp
TMP=C:\DOCUME~1\VCUSER\LOCALS~1\Temp
USERDNSDOMAIN=DOMAINNAME.BE
USERDOMAIN=DOMAINNAME
USERNAME=USERNAME
USERPROFILE=C:\Documents and Settings\USERNAME
windir=C:\WINDOWS
VMWARE_ALARM_NAME=test console
VMWARE_ALARM_ID=alarm-101
VMWARE_ALARM_TARGET_NAME=VIEW-XP4
VMWARE_ALARM_TARGET_ID=vm-4519
VMWARE_ALARM_OLDSTATUS=Gray
VMWARE_ALARM_NEWSTATUS=Red
VMWARE_ALARM_TRIGGERINGSUMMARY=Event: VM remote console connected (132281)
Summary: Remote console connected to VIEW-XP4 on host xxxxxxxxxxxxxxxxxxxxxxxxxx
Date: 12/04/2010 13:14:03
User name: DOMAINNAME\usernamethattriggeredthealert
VM: VIEW-XP4
Host: xxxxxxxxxxxxxxxxxxx
Resource pool: BRUVMWARE01
Data center: Brugge Zaal 1

VMWARE_ALARM_DECLARINGSUMMARY=([Event alarm expression: VM remote console connected; Status = Red])
VMWARE_ALARM_EVENTDESCRIPTION=Remote console connected to VIEW-XP4 on host xxxxxxxxxxxxxxxxxxxxxxxxxxx
VMWARE_ALARM_EVENT_USERNAME=DOMAINNAME\usernamethattriggeredthealert
VMWARE_ALARM_EVENT_DATACENTER=Brugge Zaal 1
VMWARE_ALARM_EVENT_COMPUTERESOURCE=BRUVMWARE01
VMWARE_ALARM_EVENT_HOST=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
VMWARE_ALARM_EVENT_VM=VIEW-XP4
VMWARE_ALARM_EVENT_NETWORK=
VMWARE_ALARM_EVENT_DATASTORE=
VMWARE_ALARM_EVENT_DVS=
VMWARE_ALARM_ALARMVALUE=Event details

So the environment variable %VMWARE_ALARM_TRIGGERINGSUMMARY% contains all the information I need. All I have to do is add a mail script to the .bat file that mails the content of this variable. The problem is that this environment variable doesn't seem to be able to pass through all the information in a .bat file. However the other variables listed above contain all the needed information aswell.

The only problem is that the alert puts a red alert sign next to the VM when it's triggered and the alarm needs to be reset to green manually, if anybody knows how to fix this, please let me know Smiley Happy

Reply
0 Kudos