Hi;
We want to collect vCenter 4 Event Log.Therefore, i have a few question:
1- Where event logs are written on vcenter 4 Server? (vCenter DB or txt file ???)
2- If we write to the vCenter DB table, how we read from this table?
3- Correlation of log files for which we need to read?
4- is there any software for vCenter 4 Event Log Correlation?
Thanks.
You can read information from the vCenter eventlog with the VMware vSphere PowerCLI cmdlet Get-VIEvent. With this cmdlet you can build your own reporting. Below you see the two examples from the Get-VIEvent help:
-------------- Example 1 -------------- C:\PS>Get-VIEvent -Entity (Get-VM -Name XP_VC_Tech) -Username admin -Type error -MaxSamples 15 Retrieves a list of the last fifteen error events on the XP_VC_Tech virtual machine for the user admin. destFolder : VimApi.FolderEventArgument destName : WebTemplate destHost : VimApi.HostEventArgument reason : VimApi.LocalizedMethodFault template : False key : 1482 chainId : 1481 createdTime : 07.5.2008 ?. 15:58:11 userName : admin datacenter : VimApi.DatacenterEventArgument computeResource : VimApi.ComputeResourceEventArgument host : VimApi.HostEventArgument vm : VimApi.VmEventArgument fullFormattedMessage : Failed to clone XP_VC_Tech: The attempted operation cann ot be performed in the current state (Powered On). dynamicType : dynamicProperty : destFolder : VimApi.FolderEventArgument destName : WebTemplate destHost : VimApi.HostEventArgument reason : VimApi.LocalizedMethodFault template : False key : 1480 chainId : 1479 createdTime : 07.5.2008 ?. 15:57:17 userName : admin datacenter : VimApi.DatacenterEventArgument computeResource : VimApi.ComputeResourceEventArgument host : VimApi.HostEventArgument vm : VimApi.VmEventArgument fullFormattedMessage : Failed to clone XP_VC_Tech: The attempted operation cann ot be performed in the current state (Powered On). dynamicType : dynamicProperty : -------------- Example 2 -------------- C:\PS>Connect-VIServer -Server 10.23.113.41 $events = Get-VIEvent -MaxSamples 100 foreach ($event in $events) {if ($event.fullFormattedMessage -match "User (.*)@\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b logged in") {Write-Host ("User " + $ matches[1] + " logged in at:" + $event.createdTime)} } Gathers information for the users that have logged in. User root logged in at:12/18/2008 12:26:02 User root logged in at:12/18/2008 12:26:02 User root logged in at:12/18/2008 12:00:51 User root logged in at:12/18/2008 12:00:50 User root logged in at:12/18/2008 12:00:47 User vpxuser logged in at:12/18/2008 12:00:46 User vpxuser logged in at:12/18/2008 12:00:46
Robert
thanks for your reply.we have already used a lot of powercli script for this case.But we want to read vcenter event log with a software for log correlation.Therefore, we need to know where event log recorded to.Which file, which folder etc.???
The eventlog is stored in the vCenter database in the tables VPX_EVENT and VPX_EVENT_ARG.
Robert
I just read that the vCenter logs are stored as text files in the file system of the vCenter server. The default location is:
C:\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\Logs
The logfiles are named vpxd-*.log.
I read this information in the vSphere 4.0 Quick Start Guide page 34.
Robert