Report Configuration Tracking with Veeam MP 6.5

[ldv]

Hi!
Is it possible to generate a report about VM configuration change tracking with the following information?
- who changed the vm configuration
- what was changed (action)
- when was it changed

I already tried to use the "Configuration Tracking and Alert Correlation" Report (Veeam VMware Analysis Reports), but it doesn't contain these information.

Thanks!

Regards,

Laura

[Mike Resseler]

Hi Laura,

Today you can see (per VM) a lot of these items. You can see which cluster it belongs to (and if changed), CPU count, CPU limit mhz and much more...

For each of these properties you can see the date it changed (including hour), what the old value was and what the new value is.

so that configuration tracking and alert correlation report should give you that information based on the objects you select (you need to select the objects from the object class VMware Virtual Machine and then the properties that you want to see (I normally select them all so I have full visibility)

What you cannot do today is see who has changed the configuration.

Hope it helps

Mike

[ldv]

Hi Mike,

Thank you for your reply!
Unfortunatly the information about 'who has changed something' is important for us. Maybe we have to create some customized reports for our company (as a feature request).


Regards,

Laura

[Alec King]

Hello Laura,

Unfortunately the problem is, that VMware does not supply this exact information that you want.

We can get the properties of any object (such as the Memory for a VM). And so we can see when that changed.

VCenter also throws an event when a user changes something. But this event is simply "User ABC changed something on object X"

It is not possible to exactly map what the user changed.

We could capture the change events in our MP (our Collector captures all vCenter events), and you could report on that. Although it still would not tell you exactly what was changed, it would tell you who was making changes. Does that meet your requirement?

Regards
Alec

[ldv]

Hi Alec,

Thanks for your reply!
Unfortunately this is not enough for us.

Why can VeeamONE collect this data?
The source for the collection is in both cases the vCenter, right?



Regards
Laura

[Alec King]

Hello Laura,

You are correct, the data source is vCenter for both Veeam ONE and Veeam MP.

However Veeam ONE has a different approach, and it scans the vCenter much more often, getting performance and properties for objects every 20 seconds.
This scanning by Veeam ONE allows them to make faster mapping of event-to-property-to-user. So they can make a pretty safe assumption in their report, for which user changed an object.

Veeam MP has different methods to collect vCenter data. For Performance data and Property data, MP scans vCenter every 5 minutes. And then there is latency when injecting property data into SCOM - this is just a factor of how SCOM works.
The MP approach is more scalable - this is the only way to support environments with 1,000s or even 10,000s of VMs integrated into SCOM.

So - we can report on the changing properties of any vSphere object, we have this report out-of-box. And we can report on which users are changing objects, we capture all those vCenter events.
But we cannot safely make assumptions about which user changed which object and exactly when.

hope that answers your question!

Thanks
Alec