Monitoring and reporting for Veeam Data Platform
Post Reply
cstemaly
Enthusiast
Posts: 50
Liked: 6 times
Joined: Aug 17, 2012 12:31 pm
Contact:

Custom Alarm for Logins

Post by cstemaly »

My goal is to track daily logins to my vCenter server.

I am creating a custom alarm called "User Logon", the rule is an event, with Event Name "UserLoginSessionEvent". I left Event Text blank, and the severity is information, and the action is just the "send to default email group" with nothing else entered.

The rule is enabled, and linked to my vCenter node (which seems right because that's where the "bad login" alarm is linked).

Nothing is showing up in any of the filters under the vCenter node.

What am I doing wrong, or should I be going about this a different way?
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Hello,
Looks like you are doing everything right. I would just ask you to double-check these points:
- Is alarm assignment correct?
- What are "Trigger after" and "Ignore after" values in the alarm`s rules?
- Please make sure event name is written in the rule exactly like it appears among vCenter events.
Thanks!
cstemaly
Enthusiast
Posts: 50
Liked: 6 times
Joined: Aug 17, 2012 12:31 pm
Contact:

Re: Custom Alarm for Logins

Post by cstemaly »

Thanks for replying!

I'm a little confused as to the event name - I think that's where I'm wrong. I got that event name from http://www.veeam.com/support/vcEvents.html

If you search for the event I'm using and click on the reference link, it does so this:
Event UserLoginSessionEvent
This event records a user logon. Because these are so prolific, they are ignored (by default) by the nworks VMware Collector.

Is the nworks VMware Collector involved here? Maybe I'm not seeing them because whatever Veeam queries is ignoring them?

All I see under vCenter->Home->Management->Events->[vCenterServerName] are the following columns (with no more to add):
Description: The User [ADUserName]@[IPAddress] logged in
Type: Information
Date Time: [DateTime]
Target: [blank]
User: [ADUserName]

I could be wrong about where to link the rule, but the vCenter Server node seems logical. As I said, that's where the "Bad Username/Password" rule is attached.
I didn't even see the "Ignore After" and "Trigger After" fields in my rule, which were both 0. I changed Ignore After to 1 and left Trigger After at 0.

After changing those two thresholds I still am not seeing any informational alerts in Veeam.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Custom Alarm for Logins

Post by Vitaliy S. »

Let me chime in...

nworks VMware Collector is not involved here, it is a Veeam MP component that has nothing to do with Veeam ONE ;)

As to further troubleshooting steps, can you please confirm that you DO see this event captured by Veeam ONE when navigating to Events tab in Monitor Client?
cstemaly
Enthusiast
Posts: 50
Liked: 6 times
Joined: Aug 17, 2012 12:31 pm
Contact:

Re: Custom Alarm for Logins

Post by cstemaly »

Thanks for the info, Vitaliy.

No, I do not see login events under the vCenter server. I'm guessing that means that I can't monitor for the event.... Is there any way to tell Veeam to pull that from... anywhere?
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Once you add vSphere to Veeam One Monitor, Veeam One starts to collect vSphere events.
Could you compare a list of events in vSphere with the events shown in Veeam One Monitor over the same time period? They have to be same. It would be great if you post the snapshots here.
Thanks!
cstemaly
Enthusiast
Posts: 50
Liked: 6 times
Joined: Aug 17, 2012 12:31 pm
Contact:

Re: Custom Alarm for Logins

Post by cstemaly »

No more worries - I got what I needed in a PowerCLI script. Thanks anyway!
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Custom Alarm for Logins

Post by Vitaliy S. »

But you can use Veeam ONE native functionality and get alarms when user tries to log in with invalid credentials. ;) In our lab we do see this event captured, so your screenshots would help to understand what you're doing.
Arturo Pedroza
Influencer
Posts: 15
Liked: never
Joined: Jul 03, 2017 5:36 pm
Full Name: Arturo Pedroza Dimas
Location: Mexico
Contact:

Re: Custom Alarm for Logins

Post by Arturo Pedroza »

Hi Vitaliy S.
I want to do the same, creating an alarm to track daily logins to my vCenter Server, any solution?

Thanks!
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Hi Arturo!
Could you provide the screenshot of the event in vSphere that you want to track in Veeam ONE?
Thanks!
Arturo Pedroza
Influencer
Posts: 15
Liked: never
Joined: Jul 03, 2017 5:36 pm
Full Name: Arturo Pedroza Dimas
Location: Mexico
Contact:

Re: Custom Alarm for Logins

Post by Arturo Pedroza »

Hi! I can't upload the screenshot but this is the event that I want to track from my vCenter Server:

"User BDDATOSDC\apedroza@192.168.78.86 logged in as VMware vSphereClient/6.0.0"

Thanks!
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Hi again Arturo!
I`ve talked to developers and it turned out that successful login events were filtered out due to big amount of complains from users who considered that event as spam.
It`s possible to remove the event from filter, to do that please contact the support team. Thanks!
Arturo Pedroza
Influencer
Posts: 15
Liked: never
Joined: Jul 03, 2017 5:36 pm
Full Name: Arturo Pedroza Dimas
Location: Mexico
Contact:

Re: Custom Alarm for Logins

Post by Arturo Pedroza »

Shestakov wrote:Hi again Arturo!
I`ve talked to developers and it turned out that successful login events were filtered out due to big amount of complains from users who considered that event as spam.
It`s possible to remove the event from filter, to do that please contact the support team. Thanks!
Thanks! I opened a case with the support team!
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Could you provide a support case number?
Thanks!
Arturo Pedroza
Influencer
Posts: 15
Liked: never
Joined: Jul 03, 2017 5:36 pm
Full Name: Arturo Pedroza Dimas
Location: Mexico
Contact:

Re: Custom Alarm for Logins

Post by Arturo Pedroza »

Shestakov wrote:Could you provide a support case number?
Thanks!
Sure! My case number is: 02219667

Thanks!
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Arturo Pedroza wrote: Sure! My case number is: 02219667
Thanks!
Arturo, did the support team help?
Arturo Pedroza
Influencer
Posts: 15
Liked: never
Joined: Jul 03, 2017 5:36 pm
Full Name: Arturo Pedroza Dimas
Location: Mexico
Contact:

Re: Custom Alarm for Logins

Post by Arturo Pedroza »

Yes, they did, unfortunately my problem could not be solved.
I hope Veeam includes a solution for this in future versions.
Anyway, thanks for the support.
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Could you elaborate on this?
Did successful login events appear after support assistance?
Thanks
Arturo Pedroza
Influencer
Posts: 15
Liked: never
Joined: Jul 03, 2017 5:36 pm
Full Name: Arturo Pedroza Dimas
Location: Mexico
Contact:

Re: Custom Alarm for Logins

Post by Arturo Pedroza »

Yes, I did, but I coldn't create a custom alarm login for specific a user, and that was my goal.

Thanks.
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: Custom Alarm for Logins

Post by Shestakov »

Does the alarm work at all(regardless particular user)?
Have you tried to type user`s name to Event text field under the Rules tab?
Post Reply

Who is online

Users browsing this forum: No registered users and 11 guests