Unreflected vCenter Events in vRops

I had planned to configure a new alert in vRealize Operations to receive notifications about changes to virtual machines including modifications to the CPU, disk, memory, and additions or removals of new hardware. However, I encountered a problem I would like to share. I attempted to create an alert that would capture all hardware configuration changes in virtual machines, to test this, I logged into vCenter and increased the size of the virtual machine’s hard disk. As anticipated, I received an event log indicating that the virtual machine had been reconfigured.

But when I checked the events tab of the virtual machine in vRops, I didn’t see any events regarding this change. I expected to see all vCenter events in vRops, but it only showed me three events after 10:17 am and none of them are related to the event that I looked for. After doing some research, I came across this article in the VMware Knowledge Base (KB) that shed some light on the situation.

In vRealize Operations Manager, there is a file called “eventlist.txt” which is a text file that contains a list of predefined events or alerts generated by the vCenter adapter. It provides a reference for the different events that can be monitored and managed within vRealize Operations Manager.

Let’s take a look at it. Log into the vRops node as root via SSH and open the following file in a text editor like vi.

/usr/lib/vmware-vcops/user/plugins/inbound/vmwarevi_adapter3/conf/eventlist.txt

You will find a list of events, with many of them already commented (indicated by a hashtag at the beginning of the line). You can easily uncomment the events you want to monitor and be visible on vRops! To navigate through the list, you can use the up and down arrow keys to scroll and view all the events.

But how am I supposed to know which events to uncomment in order to make them visible on vRops? Let’s go back and take a look at the first screenshot. You see that I’ve marked a red box in the top-right corner indicating the Event Type ID. This is what you should find and uncomment. In this case, the Event Type ID is “vim.event.VmReconfiguredEvent” Let’s search for this event in the list, as you may already know, to search in vi editor, type “/ string” and then press Enter to locate the event in the text. For example, I “/vim.event.VmReconfiguredEvent“.

Uncomment it by removing the hashtag and then to save and quit the file, press Esc key, type :wq and hit Enter key.

If the adapter runs on a Collector Group, it’s recommended to repeat this tasks on all nodes in the Collector Group, otherwise do the tasks on the node the vCenter adapter resides on.

Restart the collector service on all nodes that the eventlist.tx file was edited using the command “service vmware-vcops restart collector“.

Now let’s make a change to the virtual machine and observe the results in vRops once more. Yes! This time, the event log is displayed, allowing to track any modification made to the virtual machines’ configurations. I can even create a new alert for this event, ensuring that I receive notifications every time there is a configuration change in the virtual machine. This enhanced monitoring capability provides us with valuable insights and proactive management of our virtual environment.

As you might already know, an alert definition in vRealize operations comprises one or more symptom definitions. Symptoms are conditions that indicate issues or states in your environment. You define symptoms and then you add them to alert definitions so that you know when an issue occurs with your monitored objects. To create a new symptom, on the left side under Configure select Alerts and then click Symptom Definitions.

You can define four types of symptoms: Metric/Property, Message Event, Fault, and Metric Event. Metric/Property: Uses operational or performance values and configuration properties.
Message Event: Relies on events received as messages from vRealize Operations or external systems.
Fault Event: Based on events published by monitored systems, indicating availability issues.
Metric Event: Uses events from monitored systems where selected metrics violate thresholds.

vRops receive events and their content from vCenter which is an external system. As I intend to create a new alert based on the content of these events, I need to create a new Message Event Symptom. To do this, select Message Event and click on Add.

In the new window, start by specifying the object type for which the symptom is being evaluated. In this case, the object type is a virtual machine. Next, select the incoming event type, which is “Change” and drag the event type to the right pane. Then, provide a suitable name for this symptom and determine the evaluation criteria.

This symptom is evaluated by comparing the value of the Message Event to the event message received from vCenter. Let’s examine the message in vCenter to specify the value accurately. Please refer to the first screenshot for the event message, which is:

Reconfigured TESTVM on esxi03.vmware.local in Germany . Modified: config.hardware.device(2000).deviceInfo.summary: "26,214,400 KB" -> "27,262,976 KB"; config.hardware.device(2000).capacityInKB: 26214400 -> 27262976; config.hardware.device(2000).capacityInBytes: 26843545600 -> 27917287424; Added: Deleted:

As you can see in the event content, I have the ability to utilize every word and piece of information to compare it with the Event Message. If a word from the Event Message matches any of the words in the incoming event, it will trigger the corresponding event. I define a rule where if an event message contains the word ‘Reconfigured,’ it will trigger a symptom with an information-level criticality. Click Save.

Now, On the left side under Configure select Alerts and then click Alert Definitions.

Click Add to add a definition, and provide a name and description for the alert definition. Specify the object type (Virtual Machine) and click Next. Specify the conditions or criteria that should trigger the alert. In this case, I select the previous symptom I created and click Next. If you don’t have any recommendations, you can skip this page. Then, select the appropriate policy to apply. In a production environment, there may be multiple policies, so choose the one that fits your needs. But I have no notification rules, there is nothing to show. Simply click Next and at the end, click Create.

Now I will make a change in virtual machine configurations, such as increasing the hard disk, while the virtual machine is running. This change should trigger an alert. However, it may take approximately 5 minutes for the change to be reflected in vRops due to the synchronization interval.

As you can see, it triggers the alert! In this post, I wanted to show you by modifying the eventlist.txt file, you can define how vROps should handle specific events from vCenter.

I hope this information is helpful to you!