Creating vCenter Alarms based on Task Events such as Folder creation

The vCenter Server Events sub-system is an incredibly rich and powerful interface that enables customers to monitor, alert and even trigger additional actions based on a particular event. One such example that I have written about before is to key off of a VM provisioned event and automatically apply security hardening settings when the VM is created or cloned. This can be useful if customers are not taking advantage of VM Templates or if a VI Admins manually creates a VM from scratch, you can still ensure you have a compliant VM deployment through the use of Automation. You can either poll for the VM created event and then execute a script as shown in this example or you can automatically trigger a remote action by generating an SNMP trap when the event actually occurs.

The possibilities are truly endless on what you can do with vCenter Events and for the complete list of all Event types, you can refer to the vSphere API documentation here. One thing to be aware of is that not every operation within vCenter Server generates an Event, one example of this is when a Folder object is created or deleted. You can use vCenter Server Tasks sub-system to query for this info but there is not a respective vCenter Event that you can key off of to generate an Alarm for example. This was something I had noticed myself and assumed it was a limitation of the platform or feature teams that publish VC Events.

Recently, this question came up again from a customer who was looking for a way to trigger an alarm every time a VM Folder was created. I took another look at this and came to learn about a more generic type of Event that can be used to create an Alarm for such use cases where a native VC Event may not exists called a Task Event.

To create this new type of Alarm, we first need to gather some information which will will need in creating the Alarm definition. Let's use the VM Folder creation as an example.

Step 1 - Manually create a VM Folder and then select the parent Datacenter object and navigate to Monitor->Tasks to locate the task as shown in the example below. Next we need to record the text shown in the Related events section, in this example it is labeled "Task: Create folder" and this will be used in the next step.

Step 2 - Using the text from Step 1, we now need to retrieve the Description Id for this Task Event which we will then use in our Alarm definition. To do so, we need to use the vSphere API to inspect the vSphere Task. The easiest way to do this is to use PowerCLI but other vSphere SDKs can also be used.

Connect to your vCenter Server and then run the following snippet to retrieve all Folder create tasks and then print the DescriptionId property for the first task:

$createFolderEvents = Get-VIEvent | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Create folder" }
$createFolderEvents[0].Info.DescriptionId

The output for this particular Task Event is "Folder.createFolder" and now we have what we need to create our vCenter Alarm for when a Folder is created.

Step 3 - Create a new vCenter Alarm at the Datacenter level and then select the Task event type and click on Add Argument with the following constraint: Description ID end with Folder.createFolder as shown in the screenshot below:

Once you have completed the remainder of the Alarm definition, go ahead and save your changes.

Step 4 - Lets verify the Alarm will trigger by manually creating a Folder and you should see an alert like the one shown in the screenshot below.

With this methodology, you can now create vCenter Alarms for Task based "Events" that do not have a native VC Event.

UPDATE (11/17/20) - The following snippet can also be used to retrieve VM snapshot events:

Get-VIEvent | where {$_.GetType().Name -eq "TaskEvent" -and $_.FullFormattedMessage -eq "Task: Create virtual machine snapshot"}

UPDATE (01/16/23) - As of vSphere 8 and potentially later vSphere 7.x releases, you can no longer use the vSphere UI to create an alarm using task-based events. However, you can still use the vSphere API which includes PowerCLI to create the custom alarm. The following example below is how you create a custom alarm for VM Snapshot Reverted and to identify the specific eventType, you will need to use Get-EventType cmdlet

$eventType = Get-EventType | Where {$_.id -eq 'EventType-EventEx;FullFormat-com.vmware.vc.vm.VmStateRevertedToSnapshot'} # use Get-EventType to filter for a specific task event
$eventTrigger = New-AlarmTrigger -EventType $eventType -EntityStatus Yellow -EntityType VirtualMachine
New-AlarmDefinition -Name "**** SNAPSHOT REVERT ****" -Description "Custom VM Snapshot Reverted Alarm" -Entity (Get-VM Dummy) -Trigger $eventTrigger