[HOW TO] Articles

[Vitaliy S.]

This topic lists all Veeam and community "how to" articles:

General
Make SCOM suppress alert emails if closed < 5 min

Events Tracking
Tracking VMware VM creation in SCOM
Alert on vMotion events

Monitors
Update: Built into the product > Create SCOM Monitor for custom vCenter Alarm. Part1
Update: Built into the product > Create SCOM Monitor for custom vCenter Alarm. Part2

[sergey.g]

Introduction:
I think most of you who tried to make SCOM not to send notifications on issues resolved within N minutes noticed that Closed emails are still beeing sent no matter what you do. It's a well known limitation of notifications system design in SCOM and it is aknowledged in forums by Micsofot's representative. There were some blog post on how to workaround the issue, but they either don't work or cumbersome.

The issue is that when Alert is closed it's still marked as "updated" for SCOM and it will wait for whatever you configured as a delay and will send a Closed message after that time.

Different workarounds didn't work because they update the property of the Alert and SCOM again mark alert as "updated" and the process begins once again. Some users mentioned that you can filter out alerts not modified by SYSTEM user, but in my lab for example there is also "auto-close" system user.

The issue could appear easily with Veeam MP and very slow or very busy vCenter. Because when vCenter is busy it may pause some activity, events for example, then it will pack queued events into a single batch and just give it to our Collector at once, all at the same time (with millisecond difference)

Solution:

We will create 3 separate rules:

• First one will just send emails on a New, opened Alerts (with N minute delay to filter out alerts which have been closed within this interval)
• Second one will process Closed alerts and set a flag of whether alert is closed within N minutes. It will check for the flag and not update an event if it is already "marked" - this way we will fix the infinite loop present in other solutions, the second time script runs it won't update and the alerts is not going to be marked as "updated" by SCOM
• Third rule will just send emails on all Closed alerts with flag that it was not resolved within N minutes

So, it's pretty much obvious about the first rule. The second need to be for a command channel (make sure you've created one - I would recommend a dedicated channel and a dedicated subscriber). With respect to settings:

Script Channel settings:

Second Notification Rule settings (we are just processing all closed alerts and run a script against them):

Here is the script code (uncomment the bottom part if you need debugging):

Code: Select all

Param($alertid)
Import-Module OperationsManager
$alertid = $alertid.toString()
$alert = Get-ScomAlert -id $alertid
if($alert.CustomField10 -like "*Resolved5Min"){exit}
if(($alert.TimeResolved - $alert.TimeRaised) -lt '00:05:00'){$alert.CustomField10 = "Resolved5Min"}
else{$alert.CustomField10 = "NotResolved5Min"}
$alert.Update("Custom field 10 updated by mark_alerts script")

#$Logstring = $alertid
#$Logfile = "c:\temp\LogAlerts.log" 
#$DateTime = Get-Date –Uformat "%y-%m-%d %H:%M:%S" 
#$Logstring = $DateTime + " " + $Logstring 
#Add-content $Logfile –value $Logstring

Third Notification Rule (all alerts with a flag, we don't need to add closed alerts filter, because command subscription already performed only against Closed alerts) :


In my lab this works like a charm. Let me know if you need additiona details or have issues implementing this.

[vcharlie]

Hi all
I've written a short blog post outlining how I created an event rule to alert on VM creation, including when, where and who created the VM.
Let me know if useful. All feedback welcome.
C
http://wp.me/p4Bc56-3m

[vcharlie]

https://vmcharlie.wordpress.com/2016/06 ... s-in-scom/

Quick blog post on tracking VMotion events using the Veeam MP. Out of the box the Veeam MP does track statistics and cam display history for these events, so this post looks specifically at alerting whenever a VMotion occurs.

[sergey.g]

(Update: Built into the product)

Let me publish a little instruction on how to create a monitor for custom vCenter alarms using Veeam MP for collecting necessary events.
If you have a custom alarm configured in your vCenter, you can create the corresponding monitor in SCOM with help of Veeam MP data.
It is relatively easy.

Part 1. Using SCOM Authoring console
(Authoring console allows you to create 2-state event-based monitor only, for 3-state you will need to use another approach with modifying custom XML Management Pack)

• In SCOM Authoring Console, navigate to Monitors > Create a Monitor > Unit Monitor. Select the monitor type “Windows Events\ Simple Event Detection\Windows Event Reset”. Specify a management pack for newly created monitor.
  
• Specify a monitor name (if you want Veeam MP views to capture this Alert, make sure Monitor and Alert name starts with “Veeam VMware:”, if you want it to be captured by Host/Cluster-related views, use “Veeam VMware: Host” for host and “Veeam VMware: vSphere Cluster” for cluster)
• Specify description if necessary (it won’t appear in the alert text) and select a target (if Alarm is created for Host – specify vSphere Host as a target, if alarm is for vCenter – specify “VMware vCenter” object, if alarm for cluster – specify vSphere Cluster object as a target, for other alarm targets use similar aproach)
  
• Then you will need to specify Event log name for the unhealthy event – select Veeam VMware (you may need to connect to VMware Collector server to see this event log in the list)
  
• On the unhealthy expression page, change all default event properties. Specify Param[1]
  
• And select equal operator and AlarmStatusChangedEvent value
  
• Then add Parameter 5 equals and select id property of the Host.
  
  Note for other Alarm targets: (Parameter 6 and Display name if monitor should be targeted to vCenter)
  (Parameter 4 and Display Name for Cluster)
  (Parameter 3 and Display Name for Datacenter)
  (Parameter 8 and Id for Virtual Machine )
  
  Here is an example of Event data and the corresponding parameters:
  

  Code: Select all

  - <EventData>
    <Data>AlarmStatusChangedEvent</Data> 
    <Data>4/25/2016 12:27:08 PM</Data> 
    <Data>King Edward point</Data> 
    <Data>South Pole</Data> 
    <Data>esx-main2.dev.local</Data> 
    <Data>nworks-vc.dev.local</Data> 
    <Data>sg-sql</Data> 
    <Data> vc.dev.local:vm-18094</Data> 
    <Data /> 
    <Data /> 
    <Data>Alarm 'Virtual machine cpu usage' on sg-sql changed from Green to Red</Data> 
    <Data /> 
    </EventData>
  

  Parameter 1 – vCenter ID of the event (AlarmStatusChangedEvent)
  Parameter3 – Datacenter Name
  Parameter4 – Cluster Name
  Parameter5 – Host Name
  Parameter6 – vCenter Name
  Parameter11 – Event text with name of the alert and its status
• Specify also Parameter 11 with “Matches wildcard” operator and wildcard should be the following: “Alarm*NAME_OF_THE_ALARM*to red*”, NAME_OF_THE ALARM should be changed to the Alarm name you want to capture “to red” – for critical state, could be also “to green” for healthy and “to yellow” for warning
  
• Specify all the same parameters for Healthy event, just make sure Paramter11 has “to green” in the wildcard value
  
• Specify which state the monitor should trigger (Critical or Warning)
  
• For the Alert description specify “$Data/Context/Params/Param[11]$” – it’s going to be a text of the AlertStateChangedEvent which is mentioned above
  
• Click Create, to create a monitor.

[sergey.g]

(Update: Built into the product)

Using Custom Management Pack
This approach allows us to create 3-state monitor and helps to make several monitors in a row much faster than via the SCOM console.

• We will be using a template MP. You can download it here
• Open the file. In the <Monitoring>\<Monitors> section you will see 3 monitor templates, two for host alarm monitor and one for vcenter alarm monitor.
  Currently they are configured with some placeholder text as a name of the alarm. So to make it work with your custom alarm do the following:
  For Host-based alarm:
  • Perform Find-and-Replace and replace VCHostAlarm or VCHostAlarm2 with the ID of the new monitor, it could be name of the alarm without spaces, you can use dots also. For example VSAN.HostDisk.Error
  • Perform Find-and-Replace and replace VC_Host_AlarmName or VC_Host_AlarmName2 with the exact name of the alarm (you need to match alarm name in the AlarmStatusChanged Event), for example VSAN Disk Failure
  For vCenter-based alarm:
  • Steps are exactly the same, however placeholder for Monitor ID is VCAlarm, for Alarm Name in the wildcard expression VC_AlarmName
  For alarms targeted to other objects:
  • Duplicate Monitor declaration block, alert text string resource and Display Strings block.
  • You will need to replace placeholders as explained above, but also change a monitor target, for example from this one VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMHOST to the corresponding class type:
    Cluster - VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMCCR
    VM - VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMGUEST
    Datastore - VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMDATASTORE
  • Change Params/Param[5] in the expressions to:
    Cluster - Params/Param[4]
    VM - Params/Param[8]
    Datastore - Params/Param[10]
  • Change $Target/Property[Type="VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMHOST"]/id$ in the expression to:
    Cluster - $Target/Property[Type="System!System.Entity"]/DisplayName$ (or use the vCenter Alarm template)
    VM - $Target/Property[Type="VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMGUEST"]/id$
    Datastore - $Target/Property[Type="System!System.Entity"]/DisplayName$ (or use the vCenter Alarm template)