WilliamLam.com

Search Results for: vsphere events

Listing all Events for vCenter Server

by // 4 Comments

I had a conversation with one of our VMware Cloud on AWS field leaders a couple of weeks ago at reInvent on his initial experience with the vCenter Event Broker Appliance (VEBA) Fling. There were lots great feedback but one thing that stood out to me which looks to have been a barrier to getting started was being able to figure out a specific vCenter Event and its respective identifier. Although the list of "default" vCenter Events are documented in the vSphere API, it is definitely not the first place most folks would go to look nor is it very intuitive to browse.

To be honest, this is not a unique ask for VEBA. I have also seen this requests come up from customers who are automating vCenter Alarms, which can also be based off of vCenter Events and the same question has come up on before. One challenge with such a request is that the number and the types of vCenter Events will vary from customer to customer depending on the number of 2nd and 3rd party solutions deployed, not to mention it will also vary from version to version. In addition, as a customer, you can also publish your own custom Events into vCenter Server which makes this difficult to provide a single list that would cover all possible scenarios.

Ultimately, this ask is completely valid and I started to look at the vSphere API to see if there was something that could help. It did not take look before I stumbled onto the EventDescription which is part of the EventManager, which provides a nice registry for all currently registered vCenter Events. Time for some Automation 🙂

[Read more...]

Forwarding VMC Events to Slack using Log Intelligence Webhook

by // Leave a Comment

VMware Log Intelligence (LINT) is a public VMware Cloud Service that is available to all VMware Cloud on AWS (VMC) customers. LINT provides customers with a unified view of their SDDC infrastructure including vSphere, NSX and vSAN from a logging standpoint and LINT can also be used with an on-premises deployment. The LINT team recently published a nice overview here, which I highly recommend a read.

One really interesting capability of LINT is the alert and notification feature, which includes UI and email, but what really stood out to me with this feature is that you can also trigger a Webhook! This means you can literally integrate with any external system including public cloud services that can receive or process a Webhook. Some examples can include publishing to a specific Slack channel, sending an SMS to your SRE team, an alert in PagerDuty or even calling an AWS Lambda function. The possibilities are truly endless on what you can do with a Webhook integration!

For our recent VMC Customer Summit, I thought it would be really cool to show off some demos on what you could do with LINT Webhooks. In this blog post, I will show you how to use the If Then This That (IFTTT) service which natively supports Webhooks and publish a specific VMC event into a Slack channel. Slack also supports native webhooks, but using IFTTT, you can apply this example to other Cloud Services that you may want to integrate with.


[Read more...]

Enhanced vCenter Server Audit Event & Logging in vSphere 6.7 Update 2

by // 10 Comments

A couple of years back I had published a detailed analysis on vCenter Server's Authentication (AuthN) and Authorization (AuthZ) from an auditing and logging standpoint. This has been the go to reference for many of our customers and the posts also includes a number of log samples which I have documented in the following Github repository.

In addition to serving as a reference for our customers, it has also helped our Product and Engineering teams understand where we still had some gaps and how we could improve the overall user experience. As hinted in the recently announced vSphere 6.7 Update 2 release, which will be available soon, there are number of new auditing enhancements that have been made to both vCenter Server and the vCenter Single Sign-On (SSO) service that I think customers will really appreciate.

"Real" client IP address in Events

When you look at a login or logout Event in vCenter Server today, you may have noticed the user's client IP Address is actually of the vCenter Server rather than the actual remote client's address and the reason for this is explained here. In vSphere 6.7 Update 2, the real client IP Address is now captured and is included in all successful login/logout and failed logins. This information can now enable administrators to easily identify unauthorized access and be able to quickly track down the systems initiating the connections.

[Read more...]