Custom Alarm for Logins

Monitoring and reporting for Veeam Backup & Replication, VMware vSphere and Microsoft Hyper-V

Custom Alarm for Logins

Veeam Logoby cstemaly » Tue Jan 13, 2015 3:49 pm

My goal is to track daily logins to my vCenter server.

I am creating a custom alarm called "User Logon", the rule is an event, with Event Name "UserLoginSessionEvent". I left Event Text blank, and the severity is information, and the action is just the "send to default email group" with nothing else entered.

The rule is enabled, and linked to my vCenter node (which seems right because that's where the "bad login" alarm is linked).

Nothing is showing up in any of the filters under the vCenter node.

What am I doing wrong, or should I be going about this a different way?
cstemaly
Enthusiast
 
Posts: 50
Liked: 6 times
Joined: Fri Aug 17, 2012 12:31 pm

Re: Custom Alarm for Logins

Veeam Logoby Shestakov » Tue Jan 13, 2015 4:25 pm

Hello,
Looks like you are doing everything right. I would just ask you to double-check these points:
- Is alarm assignment correct?
- What are "Trigger after" and "Ignore after" values in the alarm`s rules?
- Please make sure event name is written in the rule exactly like it appears among vCenter events.
Thanks!
Shestakov
Veeam Software
 
Posts: 4863
Liked: 396 times
Joined: Wed May 21, 2014 11:03 am
Location: Saint Petersburg
Full Name: Nikita Shestakov

Re: Custom Alarm for Logins

Veeam Logoby cstemaly » Tue Jan 13, 2015 8:21 pm

Thanks for replying!

I'm a little confused as to the event name - I think that's where I'm wrong. I got that event name from http://www.veeam.com/support/vcEvents.html

If you search for the event I'm using and click on the reference link, it does so this:
Event UserLoginSessionEvent
This event records a user logon. Because these are so prolific, they are ignored (by default) by the nworks VMware Collector.

Is the nworks VMware Collector involved here? Maybe I'm not seeing them because whatever Veeam queries is ignoring them?

All I see under vCenter->Home->Management->Events->[vCenterServerName] are the following columns (with no more to add):
Description: The User [ADUserName]@[IPAddress] logged in
Type: Information
Date Time: [DateTime]
Target: [blank]
User: [ADUserName]

I could be wrong about where to link the rule, but the vCenter Server node seems logical. As I said, that's where the "Bad Username/Password" rule is attached.
I didn't even see the "Ignore After" and "Trigger After" fields in my rule, which were both 0. I changed Ignore After to 1 and left Trigger After at 0.

After changing those two thresholds I still am not seeing any informational alerts in Veeam.
cstemaly
Enthusiast
 
Posts: 50
Liked: 6 times
Joined: Fri Aug 17, 2012 12:31 pm

Re: Custom Alarm for Logins

Veeam Logoby Vitaliy S. » Tue Jan 13, 2015 9:07 pm

Let me chime in...

nworks VMware Collector is not involved here, it is a Veeam MP component that has nothing to do with Veeam ONE ;)

As to further troubleshooting steps, can you please confirm that you DO see this event captured by Veeam ONE when navigating to Events tab in Monitor Client?
Vitaliy S.
Veeam Software
 
Posts: 19575
Liked: 1104 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Custom Alarm for Logins

Veeam Logoby cstemaly » Tue Jan 20, 2015 4:57 pm

Thanks for the info, Vitaliy.

No, I do not see login events under the vCenter server. I'm guessing that means that I can't monitor for the event.... Is there any way to tell Veeam to pull that from... anywhere?
cstemaly
Enthusiast
 
Posts: 50
Liked: 6 times
Joined: Fri Aug 17, 2012 12:31 pm

Re: Custom Alarm for Logins

Veeam Logoby Shestakov » Tue Jan 20, 2015 5:47 pm

Once you add vSphere to Veeam One Monitor, Veeam One starts to collect vSphere events.
Could you compare a list of events in vSphere with the events shown in Veeam One Monitor over the same time period? They have to be same. It would be great if you post the snapshots here.
Thanks!
Shestakov
Veeam Software
 
Posts: 4863
Liked: 396 times
Joined: Wed May 21, 2014 11:03 am
Location: Saint Petersburg
Full Name: Nikita Shestakov

Re: Custom Alarm for Logins

Veeam Logoby cstemaly » Tue Jan 20, 2015 8:26 pm

No more worries - I got what I needed in a PowerCLI script. Thanks anyway!
cstemaly
Enthusiast
 
Posts: 50
Liked: 6 times
Joined: Fri Aug 17, 2012 12:31 pm

Re: Custom Alarm for Logins

Veeam Logoby Vitaliy S. » Tue Jan 20, 2015 8:36 pm

But you can use Veeam ONE native functionality and get alarms when user tries to log in with invalid credentials. ;) In our lab we do see this event captured, so your screenshots would help to understand what you're doing.
Vitaliy S.
Veeam Software
 
Posts: 19575
Liked: 1104 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Custom Alarm for Logins

Veeam Logoby Arturo Pedroza » Mon Jul 03, 2017 10:35 pm

Hi Vitaliy S.
I want to do the same, creating an alarm to track daily logins to my vCenter Server, any solution?

Thanks!
Arturo Pedroza
Influencer
 
Posts: 13
Liked: never
Joined: Mon Jul 03, 2017 5:36 pm
Location: Mexico
Full Name: Arturo Pedroza Dimas

Re: Custom Alarm for Logins

Veeam Logoby Shestakov » Fri Jul 07, 2017 10:51 pm

Hi Arturo!
Could you provide the screenshot of the event in vSphere that you want to track in Veeam ONE?
Thanks!
Shestakov
Veeam Software
 
Posts: 4863
Liked: 396 times
Joined: Wed May 21, 2014 11:03 am
Location: Saint Petersburg
Full Name: Nikita Shestakov

Re: Custom Alarm for Logins

Veeam Logoby Arturo Pedroza » Mon Jul 10, 2017 5:53 pm

Hi! I can't upload the screenshot but this is the event that I want to track from my vCenter Server:

"User BDDATOSDC\apedroza@192.168.78.86 logged in as VMware vSphereClient/6.0.0"

Thanks!
Arturo Pedroza
Influencer
 
Posts: 13
Liked: never
Joined: Mon Jul 03, 2017 5:36 pm
Location: Mexico
Full Name: Arturo Pedroza Dimas

Re: Custom Alarm for Logins

Veeam Logoby Shestakov » Wed Jul 12, 2017 1:33 pm

Hi again Arturo!
I`ve talked to developers and it turned out that successful login events were filtered out due to big amount of complains from users who considered that event as spam.
It`s possible to remove the event from filter, to do that please contact the support team. Thanks!
Shestakov
Veeam Software
 
Posts: 4863
Liked: 396 times
Joined: Wed May 21, 2014 11:03 am
Location: Saint Petersburg
Full Name: Nikita Shestakov

Re: Custom Alarm for Logins

Veeam Logoby Arturo Pedroza » Wed Jul 12, 2017 4:39 pm

Shestakov wrote:Hi again Arturo!
I`ve talked to developers and it turned out that successful login events were filtered out due to big amount of complains from users who considered that event as spam.
It`s possible to remove the event from filter, to do that please contact the support team. Thanks!


Thanks! I opened a case with the support team!
Arturo Pedroza
Influencer
 
Posts: 13
Liked: never
Joined: Mon Jul 03, 2017 5:36 pm
Location: Mexico
Full Name: Arturo Pedroza Dimas

Re: Custom Alarm for Logins

Veeam Logoby Shestakov » Wed Jul 12, 2017 4:40 pm

Could you provide a support case number?
Thanks!
Shestakov
Veeam Software
 
Posts: 4863
Liked: 396 times
Joined: Wed May 21, 2014 11:03 am
Location: Saint Petersburg
Full Name: Nikita Shestakov

Re: Custom Alarm for Logins

Veeam Logoby Arturo Pedroza » Wed Jul 12, 2017 4:45 pm

Shestakov wrote:Could you provide a support case number?
Thanks!


Sure! My case number is: 02219667

Thanks!
Arturo Pedroza
Influencer
 
Posts: 13
Liked: never
Joined: Mon Jul 03, 2017 5:36 pm
Location: Mexico
Full Name: Arturo Pedroza Dimas

Next

Return to Veeam ONE



Who is online

Users browsing this forum: No registered users and 4 guests