Thanks for replying!
I'm a little confused as to the event name - I think that's where I'm wrong. I got that event name from http://www.veeam.com/support/vcEvents.html
If you search for the event I'm using and click on the reference link, it does so this:
This event records a user logon. Because these are so prolific, they are ignored (by default) by the nworks VMware Collector.
Is the nworks VMware Collector involved here? Maybe I'm not seeing them because whatever Veeam queries is ignoring them?
All I see under vCenter->Home->Management->Events->[vCenterServerName] are the following columns (with no more to add):
Description: The User [ADUserName]@[IPAddress] logged in
Date Time: [DateTime]
I could be wrong about where to link the rule, but the vCenter Server node seems logical. As I said, that's where the "Bad Username/Password" rule is attached.
I didn't even see the "Ignore After" and "Trigger After" fields in my rule, which were both 0. I changed Ignore After to 1 and left Trigger After at 0.
After changing those two thresholds I still am not seeing any informational alerts in Veeam.