System Center

How To: Track VMware vMotion events in SCOM

Posted on by vmcharlie

Tracking VMware vMotion events in SCOM through the Veeam Management Pack for System Center

To track vMotion events I created a new alert rule (called vMotionAlerts in this example).

The rule parameters include the Vmware Virtual Machine as the Rule Target, as depicted here:

rule props

The event source will be the Veeam Vmware log on the VICs (Veeam Virtual Infrastructure Collectors).

ds props

In the Expression  builder there are a couple of things to bear in mind:

  • First is that the Event id’s for vMotion events are…
    • 414 = vmotion (used in this example, and repeat for the other event codes as necessary)
    • 266 = drs
    • 450 = storage vmotion
  • Second, and important is that you need to specify the Event Parameter number, and it should be 8 (it was in my MP version 8 lab, and you can verify by looking at the raw event data in the Veeam Vmware event log and counting down the lines). The value should equal the “id” value when you browse through the ellipses (screenshot below)

exp props

In my example I set the severity to be ‘Information’ and the Priority ‘Low’ as vMotions are typically not a health warning sign, but of course you can set to your taste.

 

Prefix the alert name with “Veeam VMware:” to have it appear under the Veeam for VMware MP.

 

I also updated the alert description to include who sparked the vMotion. This is done under Alert responses and included as parameter 12 in the alert description (I added the ‘Moved by:’ text manually).

alert params

With this configuration the Source is the actual VM that was migrated (rather than the VIC) and the event description contains the to-and-from information (host, Datacenter and Datastore) and who performed the migration, making custom views easier e.g. all alerts relating to a given VM, including vMotions.

 

The resulting alert looks like this:

Leave a comment