How To: Track VMware VM Creation in SCOM

Tracking VMware Virtual Machine Creation in SCOM through the Veeam Management Pack for System Center

To track VM creation through SCOM I created an event-rule looking for the specific event for VM creation on a host. In event viewer on the Veeam Collector (Veeam VMware log) this is event id 410.

I created a custom management pack to contain this rule called Veeam.vmCreation.alert

The rule gets targeted to a vSphere host. Note you can configure the rule (and alert) name to start with “Veeam VMware:” so that the alerts appear under the Veeam Management Pack, rather than just in the general alert population.


rule general tab

Under rule configuration Data sources, the log name you need is ‘Veeam VMware’. You can select the ellipses and browse to a Veeam Collector to find this log:

ds props

Under the expression tab, specify event ID equals 410. In this case we are tracking the VM creation on a host so it is important to specify a matching parameter name to avoid being inundated by alerts (from every VM) whenever a single VM is created. The parameter we need here is 5, and it should equal the Display Name attribute:

ds props exp

I’ve set the severity of the alert to be Informational (VM creation may not really require a red flag) and priority Low.

I’ve also added in additional parameter information to round out the information contained in the alert. In this example I’ve included the VM name (parameter 7 from the source event), host (param5) and datacenter names (param4 – all already contained in the default event description), as well as the Cluster name (param3) and who created the VM (param12). For each of the parameters in the alert response I prefixed them with text (“VM name:”, “Host name:” etc.) Note that quotes “” are not required.

alert props

When a VM gets created the resulting alert looks like this:



If I want to track VM creations over time I can use SCOM reporting to help me trend and analyze this data. For example, I can use the Veeam Alert History report to show me VM’s created over a specified period:

report top

With the report scoped to my VeeamVMCreationAlert management pack and targeted to hosts I can see the number of VM creation alerts per day and alert details:


The alert statistics report (below ‘Alert history’ in the Veeam Report Library) will show me the alerts stats over two time periods which can be useful if you want to figure out if more VM’s were created (alerted) last quarter compared to this quarter, for example.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s