How is Event Based rule triggered?

Monitoring and reporting for Veeam Backup & Replication, VMware vSphere and Microsoft Hyper-V

How is Event Based rule triggered?

Veeam Logoby edmund.tan@aveva.com » Wed Oct 23, 2013 4:01 am

Hi Guys,

How are event based rule are triggered? For example if 1 of the alarm Static Mac address conflict, consist of a Event based rule with the Event Name 12562 Microsoft-Windows-Hyper-V-SynthNic.
So my assumption is if there were MAC add conflicts, the trigger is fired based from VEEAM One when it detects an entry in the VM's event viewer for the value 12562?
edmund.tan@aveva.com
Novice
 
Posts: 6
Liked: never
Joined: Wed Oct 23, 2013 3:54 am

Re: How is Event Based rule triggered?

Veeam Logoby Vitaliy S. » Wed Oct 23, 2013 10:28 am

Hi Edmund,

Yes, event based alarms are fired once the corresponding event is captured by Veeam ONE Server, and the captured event is visible in the events tab of either parent object or the VM itself.

Thanks!
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: How is Event Based rule triggered?

Veeam Logoby edmund.tan@aveva.com » Thu Oct 24, 2013 6:51 am

Hi Vitaliy,

I tried creating a custom event rule for a test. The event ID is 4625 and its a logon audit (failure). I tried intentionally login the hyper-v server with wrong password,
the event ID was log in the event viewer but doesn't trigger an alarm in Veeam One monitor. I named the Event name column in the Rule Tab of Alarm Management to the event ID,
so am i doing something wrong? Or perhaps do you have an example for me to refer? Can't seem to find any of this in the user guide.

Thanks!
edmund.tan@aveva.com
Novice
 
Posts: 6
Liked: never
Joined: Wed Oct 23, 2013 3:54 am

Re: How is Event Based rule triggered?

Veeam Logoby Vitaliy S. » Thu Oct 24, 2013 10:46 am

edmund.tan@aveva.com wrote:the event ID was log in the event viewer but doesn't trigger an alarm in Veeam One monitor.

The first thing to check here is whether this event is captured by Veeam ONE server or not. Please be aware that we DO filter some of the events from the Hyper-V server.
edmund.tan@aveva.com wrote: I named the Event name column in the Rule Tab of Alarm Management to the event ID, so am i doing something wrong? Or perhaps do you have an example for me to refer?

What event name is displayed (Events tab) in Veeam ONE Monitor Client for this action?
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: How is Event Based rule triggered?

Veeam Logoby edmund.tan@aveva.com » Fri Oct 25, 2013 1:28 am

I'd assume you meant the Tasks & Events tab under the hyper-v server. There's nothing there, so i think nothing is captured.
When you say you do filters what do you meant by that?
edmund.tan@aveva.com
Novice
 
Posts: 6
Liked: never
Joined: Wed Oct 23, 2013 3:54 am

Re: How is Event Based rule triggered?

Veeam Logoby Vitaliy S. » Fri Oct 25, 2013 10:54 am

Well...as you know there are lots of events and event logs in the Windows Server, so we capture only Hyper-V related events. All events from Microsoft-Windows-Hyper-V-SynthNic should be there, let me ask our QC team to reproduce your situation and check whether the event you need exists in Veeam ONE Monitor Client or not.

Are you trying to capture only this one - "event ID is 4625 and its a logon audit (failure)"?
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: How is Event Based rule triggered?

Veeam Logoby Vitaliy S. » Fri Oct 25, 2013 1:24 pm

Our QC team has confirmed that this event is generated in the Security event log, thus this information is not currently collected by Veeam ONE. We are planning to address this in our next updates. Thanks for the heads up and for the feedback provided!
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: How is Event Based rule triggered?

Veeam Logoby edmund.tan@aveva.com » Sun Oct 27, 2013 7:00 am

Ah i see. I operated under the assumption Veeam One would collect all logs coming out of windows server. And yes logon audit is one of the events we would like to catch if possible.
Looking forward to your next update!.

I would appreciate if you could provide an exhaustive list of events that is capture-able by Veeam One. (the Veeam One user guide doesn't really seem to explain much on event based rule management).
edmund.tan@aveva.com
Novice
 
Posts: 6
Liked: never
Joined: Wed Oct 23, 2013 3:54 am

Re: How is Event Based rule triggered?

Veeam Logoby Vitaliy S. » Sun Oct 27, 2013 8:30 am

Ok, I will pass this information to our technical writers team.
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: How is Event Based rule triggered?

Veeam Logoby edmund.tan@aveva.com » Mon Feb 10, 2014 8:18 am

Hi Vitaliy,

Is there by any chance this issue is resolved for the R2 patch?

With Regards,
Edmund
edmund.tan@aveva.com
Novice
 
Posts: 6
Liked: never
Joined: Wed Oct 23, 2013 3:54 am

Re: How is Event Based rule triggered?

Veeam Logoby Vitaliy S. » Mon Feb 10, 2014 11:03 am

Hi Edmund,

This has been fixed in the next major version, which is scheduled for this year.

Thanks!
Vitaliy S.
Veeam Software
 
Posts: 19539
Liked: 1097 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov


Return to Veeam ONE



Who is online

Users browsing this forum: No registered users and 3 guests