How is Event Based rule triggered?

[edmund.tan@aveva.com]

Hi Guys,

How are event based rule are triggered? For example if 1 of the alarm Static Mac address conflict, consist of a Event based rule with the Event Name 12562 Microsoft-Windows-Hyper-V-SynthNic.
So my assumption is if there were MAC add conflicts, the trigger is fired based from VEEAM One when it detects an entry in the VM's event viewer for the value 12562?

[Vitaliy S.]

Hi Edmund,

Yes, event based alarms are fired once the corresponding event is captured by Veeam ONE Server, and the captured event is visible in the events tab of either parent object or the VM itself.

Thanks!

[edmund.tan@aveva.com]

Hi Vitaliy,

I tried creating a custom event rule for a test. The event ID is 4625 and its a logon audit (failure). I tried intentionally login the hyper-v server with wrong password,
the event ID was log in the event viewer but doesn't trigger an alarm in Veeam One monitor. I named the Event name column in the Rule Tab of Alarm Management to the event ID,
so am i doing something wrong? Or perhaps do you have an example for me to refer? Can't seem to find any of this in the user guide.

Thanks!

[Vitaliy S.]

the event ID was log in the event viewer but doesn't trigger an alarm in Veeam One monitor.

The first thing to check here is whether this event is captured by Veeam ONE server or not. Please be aware that we DO filter some of the events from the Hyper-V server.

I named the Event name column in the Rule Tab of Alarm Management to the event ID, so am i doing something wrong? Or perhaps do you have an example for me to refer?

What event name is displayed (Events tab) in Veeam ONE Monitor Client for this action?

[edmund.tan@aveva.com]

I'd assume you meant the Tasks & Events tab under the hyper-v server. There's nothing there, so i think nothing is captured.
When you say you do filters what do you meant by that?

[Vitaliy S.]

Well...as you know there are lots of events and event logs in the Windows Server, so we capture only Hyper-V related events. All events from Microsoft-Windows-Hyper-V-SynthNic should be there, let me ask our QC team to reproduce your situation and check whether the event you need exists in Veeam ONE Monitor Client or not.

Are you trying to capture only this one - "event ID is 4625 and its a logon audit (failure)"?

[Vitaliy S.]

Our QC team has confirmed that this event is generated in the Security event log, thus this information is not currently collected by Veeam ONE. We are planning to address this in our next updates. Thanks for the heads up and for the feedback provided!

[edmund.tan@aveva.com]

Ah i see. I operated under the assumption Veeam One would collect all logs coming out of windows server. And yes logon audit is one of the events we would like to catch if possible.
Looking forward to your next update!.

I would appreciate if you could provide an exhaustive list of events that is capture-able by Veeam One. (the Veeam One user guide doesn't really seem to explain much on event based rule management).

[Vitaliy S.]

Ok, I will pass this information to our technical writers team.

[edmund.tan@aveva.com]

Hi Vitaliy,

Is there by any chance this issue is resolved for the R2 patch?

With Regards,
Edmund

[Vitaliy S.]

Hi Edmund,

This has been fixed in the next major version, which is scheduled for this year.

Thanks!