Search Results for: VOB

New VOBs for creating vCenter Server alarms in vSphere 6.0

03.02.2015 by William Lam // Leave a Comment

Here are some new VOBs in vSphere 6.0 that I recently came across which can be useful on getting notified on specific events such failed login attempts in ESXi or detecting a device has gone offline in VSAN as some examples. These VOBs can be used to create vCenter Server alarms to take various actions such as a simple UI notification in the vSphere Web/C# Client to sending an email or SNMP trap regarding the event. For more information on how create vCenter Server alarms using VOBs, please take a look at these two articles here and here which also includes a comprehensive list of past vSphere VOBs in vSphere 5.5 which are still applicable in vSphere 6.0.

General vSphere 6.0 VOBs

VOB ID	VOB Description
esx.audit.account.locked	Remote access for an ESXi local user account has been locked temporarilly due to multiple failed login attempts.
esx.audit.account.loginfailures	Multiple remote login failures detected for an ESXi local user account.
esx.audit.esxcli.host.restart	Rebooting host through esxcli
esx.audit.lockdownmode.exceptions.changed	List of lockdown exception users has been changed.
esx.problem.coredump.copyspace	The free space available in default coredump copy location is insufficient to copy new coredumps.
esx.problem.coredump.extraction.failed.nospace	The given partition has insufficient amount of free space to extract the coredump.
esx.problem.dhclient.lease.offered.error	No expiry time on offered DHCP lease.
esx.problem.pageretire.selectedbutnotretired.high	Number of host physical memory pages that have been selected for retirement but could not yet be retired is high.
esx.problem.swap.systemSwap.isPDL.cannot.remove	System swap at path {1} was affected by the PDL of its datastore and was removed. System swap has been reconfigured.
esx.problem.swap.systemSwap.isPDL.removed.reconfig.failure	System swap at path {1} was affected by the PDL of its datastore. It was removed but the subsequent reconfiguration failed.
esx.problem.vmfs.ats.incompatibility.detected	Multi-extent ATS-only VMFS Volume unable to use ATS
esx.problem.vmfs.lockmode.inconsistency.detected	Inconsistent VMFS lockmode detected.
esx.problem.vmfs.spanned.lockmode.inconsistency.detected	Inconsistent VMFS lockmode detected on spanned volume.
esx.problem.vmfs.spanstate.incompatibility.detected	Incompatible VMFS span state detected.
esx.vFlash.VFlashResourceCapacityExtendedEvent	vFlash resource capacity is extended
vprob.vmfs.heartbeat.corruptondisk	VMFS Heartbeat Corruption Detected

VSAN 6.0 VOBs

VOB ID	VOB Description
esx.audit.vsan.net.vnic.added	Virtual SAN virtual NIC has been added.
esx.audit.vsan.net.vnic.deleted	Virtual SAN network configuration has been removed.
esx.problem.vob.vsan.dom.lsefixed	Virtual SAN detected and fixed a medium error on disk.
esx.problem.vob.vsan.dom.nospaceduringresync	Resync encountered no space error
esx.problem.vob.vsan.lsom.disklimit2	Failed to add disk to disk group.
esx.problem.vsan.dom.init.failed.status	Virtual SAN Distributed Object Manager failed to initialize
vprob.vob.vsan.pdl.offline	Virtual SAN device has gone offline.

Other handy vSphere VOBs for creating vCenter Alarms

04.24.2014 by William Lam // 8 Comments

Lately I have been writing on a variety of topics regarding the use of VOBs (VMkernel Observations) for creating useful vCenter Alarms such as:

I figure it would also be useful to collect a list of all the vSphere VOBs, at least from what I can gather by looking at /usr/lib/vmware/hostd/extensions/hostdiag/locale/en/event.vmsg on the latest version of ESXi. The list below is quite extensive, there are a total of 308 vSphere VOBs not including the VSAN VOBs in my previous articles. For those those of you who use vSphere Replication, you may also find a couple of handy ones in the list.

[Read more...]

Handy VSAN VOBs for creating vCenter Alarms

04.22.2014 by William Lam // 3 Comments

There have been quite a few questions lately around vCenter Server Alarms for VSAN, one in particular that I have noticed is around individual disk failure for VSAN. Outside of the generic default datastore alarms, there seems to be only two VSAN specific alarms:

I figure there must be other useful alarms that we could create, especially after showing how you can create a vCenter Server Alarm to monitor the VSAN component count threshold based on a particular VSAN VOB. I took a look around and found the following VSAN specific VOBs which could be useful for creating additional vCenter Alarms.

VOB ID	VOB Description
esx.audit.vsan.clustering.enabled	VSAN clustering services have been enabled.
esx.clear.vob.vsan.pdl.online	VSAN device has come online.
esx.clear.vsan.clustering.enabled	VSAN clustering services have now been enabled.
esx.clear.vsan.vsan.network.available	VSAN now has at least one active network configuration.
esx.clear.vsan.vsan.vmknic.ready	A previously reported vmknic now has a valid IP.
esx.problem.vob.vsan.lsom.componentthreshold	VSAN Node: Near node component count limit.
esx.problem.vob.vsan.lsom.diskerror	VSAN device is under permanent error.
esx.problem.vob.vsan.lsom.diskgrouplimit	Failed to create a new disk group.
esx.problem.vob.vsan.lsom.disklimit	Failed to add disk to disk group.
esx.problem.vob.vsan.pdl.offline	VSAN device has gone offline.
esx.problem.vsan.clustering.disabled	VSAN clustering services have been disabled.
esx.problem.vsan.lsom.congestionthreshold	VSAN device Memory/SSD congestion has changed.
esx.problem.vsan.net.not.ready	A vmknic added to VSAN network configuration doesn't have valid IP. Network is not ready.
esx.problem.vsan.net.redundancy.lost	VSAN doesn't haven any redundancy in its network configuration.
esx.problem.vsan.net.redundancy.reduced	VSAN is operating on reduced network redundancy.
esx.problem.vsan.no.network.connectivity	VSAN doesn't have any networking configuration for use.
esx.problem.vsan.vmknic.not.ready	A vmknic added to VSAN network configuration doesn't have valid IP. It will not be in use.

Looking at the list above, the following two VOBs seems like they would be useful for alerting on a disk failure is:

esx.problem.vob.vsan.lsom.diskerror
esx.problem.vob.vsan.pdl.offline

Disclaimer: There are no guarantees that a disk error or failure will automatically trigger these VOBs due to the unknown nature of how a disk may be fail, especially if it is intermittently.

Even though we can not simulate a disk error on a physical disk, we can still do some magic using a Nested VSAN environment. The worse case scenario that you could run into is that one of the disk just goes completely offline. We can simulate a similar behavior in a Nested ESXi environment by removing one of the virtual disks from the Virtual Machine (not deleting it).

To demonstrate the following scenario, here are the steps to create a vCenter Alarm for the following two VOBs:

Step 1 - Create a new vCenter Alarm and give it a name. Select “Hosts” for Monitor and “Specific event occurring …” for Monitor:

Step 2 - Add the following two VOBs above into the Event trigger:

Step 3 - Remove one of the Virtual Disks (SSD/MD) from the Virtual Machine running the Nested ESXi VM.

Step 4 - There are two ways in which you can trigger the alarm. You can either create a new Virtual Machine which will try to write to the Nested ESXi VM in which you remove the Virtual Disk or you can rescan the storage adapter for the Nested ESXi VM. In my environment, I happen to have a VM running on an NFS datastore and I performed a Storage vMotion of the VM onto my VSAN Datastore using the default FTT=1 policy on a three node VSAN Cluster. This immediately triggered the alarm as seen in the screenshots below: