alerts in SCOM when VMs automatically vMotion

[sbanyas]

I have been tasked with creating alerts when our VMs automatically vMotion to other ESX hosts.

I see in the Veeam VMware log the following event corresponding to the vMotion:

Log Name: Veeam VMware
Source: VC
Event ID: 450
Level: Information

This appears to relate to the DrsVmMigratedEvent
DRS migrated {vm.name> from {sourceHost.name} to {host.name} in cluster {computeResource.name} in {datacenter.name}

Can I configure the Veeam Management Pack to pick up such an event and alert? The "out of the box" SCOM event log monitor could be used, but the "sourcing" of the event would be wrong...it would appear to come from the collector where the Veeam VMware event log is located and not the {vm.name} that actually vmotioned.

If this topic has been covered in previous posts, I apologize. I searched and didn't find anything relevant to my question.

[Alec King]

Hi Scott,

Yes, indeed you can create an alert for any event that our Veeam Collector posts. We have customers who created alerts for VM Powered Off, VM Rebooted, all kinds of customizations are possible.

You are almost there with your research into the events in our Veeam VMware log. Below should get you the rest of the way!

How to raise this alert against the specific VM - When you create the Rule or Monitor - instead of using computer or agent as the Target, use our Veeam class 'VMware Virtual Machine'

When SCOM runs this rule, it will find that all instances of this VMware Virtual Machine class are 'managed' by Veeam Collectors. So the rule will automatically run on Collectors. And if the alert is raised, it will appear against the VM object in SCOM.
Very important to add to your criteria when you build the Event Expression - check that Parameter 8 Equals id (pick id from the '...' menu which shows all class properties.)
The criterion should finally be like Parameter 8 Equals $Target/Property[Type="VeeamVirtExtensionsVMwareLibrary!Veeam.Virt.Extensions.VMware.VMGUEST"]/id$
Matching to Parameter 8 means that the alert will fire only for your chosen VM. (Without this check, it would fire multiple alerts for ALL of the VMs from one single event - not desired! )
You can double-check which parameter you need by viewing the Veeam event details in event viewer (because some event classes use different parameters) - you can count the parameters and check that #8 matches the id used for VM class (VM ID is composed of vCenter-ID:VM-ID)

Hope that helps - any questions please let us know,
Thanks!
Alec

[Cragdoo]

Might be worth pointing out that depending on the level your DRS is set to, and how contented the resources are, you may get quite a few alerts as DRS redistributes the VMs. Out of curiosity, is there any particular reason you want to be alerted when a VM is vmotioned ?