Custom Alarm for Logins

[cstemaly]

My goal is to track daily logins to my vCenter server.

I am creating a custom alarm called "User Logon", the rule is an event, with Event Name "UserLoginSessionEvent". I left Event Text blank, and the severity is information, and the action is just the "send to default email group" with nothing else entered.

The rule is enabled, and linked to my vCenter node (which seems right because that's where the "bad login" alarm is linked).

Nothing is showing up in any of the filters under the vCenter node.

What am I doing wrong, or should I be going about this a different way?

[Shestakov]

Hello,
Looks like you are doing everything right. I would just ask you to double-check these points:
- Is alarm assignment correct?
- What are "Trigger after" and "Ignore after" values in the alarm`s rules?
- Please make sure event name is written in the rule exactly like it appears among vCenter events.
Thanks!

[cstemaly]

Thanks for replying!

I'm a little confused as to the event name - I think that's where I'm wrong. I got that event name from http://www.veeam.com/support/vcEvents.html

If you search for the event I'm using and click on the reference link, it does so this:
Event UserLoginSessionEvent
This event records a user logon. Because these are so prolific, they are ignored (by default) by the nworks VMware Collector.

Is the nworks VMware Collector involved here? Maybe I'm not seeing them because whatever Veeam queries is ignoring them?

All I see under vCenter->Home->Management->Events->[vCenterServerName] are the following columns (with no more to add):
Description: The User [ADUserName]@[IPAddress] logged in
Type: Information
Date Time: [DateTime]
Target: [blank]
User: [ADUserName]

I could be wrong about where to link the rule, but the vCenter Server node seems logical. As I said, that's where the "Bad Username/Password" rule is attached.
I didn't even see the "Ignore After" and "Trigger After" fields in my rule, which were both 0. I changed Ignore After to 1 and left Trigger After at 0.

After changing those two thresholds I still am not seeing any informational alerts in Veeam.

[Vitaliy S.]

Let me chime in...

nworks VMware Collector is not involved here, it is a Veeam MP component that has nothing to do with Veeam ONE

As to further troubleshooting steps, can you please confirm that you DO see this event captured by Veeam ONE when navigating to Events tab in Monitor Client?

[cstemaly]

Thanks for the info, Vitaliy.

No, I do not see login events under the vCenter server. I'm guessing that means that I can't monitor for the event.... Is there any way to tell Veeam to pull that from... anywhere?

[Shestakov]

Once you add vSphere to Veeam One Monitor, Veeam One starts to collect vSphere events.
Could you compare a list of events in vSphere with the events shown in Veeam One Monitor over the same time period? They have to be same. It would be great if you post the snapshots here.
Thanks!

[cstemaly]

No more worries - I got what I needed in a PowerCLI script. Thanks anyway!

[Vitaliy S.]

But you can use Veeam ONE native functionality and get alarms when user tries to log in with invalid credentials. In our lab we do see this event captured, so your screenshots would help to understand what you're doing.

[Arturo Pedroza]

Hi Vitaliy S.
I want to do the same, creating an alarm to track daily logins to my vCenter Server, any solution?

Thanks!

[Shestakov]

Hi Arturo!
Could you provide the screenshot of the event in vSphere that you want to track in Veeam ONE?
Thanks!

[Arturo Pedroza]

Hi! I can't upload the screenshot but this is the event that I want to track from my vCenter Server:

"User BDDATOSDC\apedroza@192.168.78.86 logged in as VMware vSphereClient/6.0.0"

Thanks!

[Shestakov]

Hi again Arturo!
I`ve talked to developers and it turned out that successful login events were filtered out due to big amount of complains from users who considered that event as spam.
It`s possible to remove the event from filter, to do that please contact the support team. Thanks!

[Arturo Pedroza]

Hi again Arturo!
I`ve talked to developers and it turned out that successful login events were filtered out due to big amount of complains from users who considered that event as spam.
It`s possible to remove the event from filter, to do that please contact the support team. Thanks!

Thanks! I opened a case with the support team!

[Shestakov]

Could you provide a support case number?
Thanks!

[Arturo Pedroza]

Could you provide a support case number?
Thanks!

Sure! My case number is: 02219667

Thanks!

[Shestakov]

Sure! My case number is: 02219667
Thanks!

Arturo, did the support team help?

[Arturo Pedroza]

Yes, they did, unfortunately my problem could not be solved.
I hope Veeam includes a solution for this in future versions.
Anyway, thanks for the support.

[Shestakov]

Could you elaborate on this?
Did successful login events appear after support assistance?
Thanks

[Arturo Pedroza]

Yes, I did, but I coldn't create a custom alarm login for specific a user, and that was my goal.

Thanks.

[Shestakov]

Does the alarm work at all(regardless particular user)?
Have you tried to type user`s name to Event text field under the Rules tab?