Home
  •  

Veeam vSphere Host Syslog: Syslog daemon service shutdown

Veeam.Virt.Extensions.VMware.VMHOST.SyslogEvents.syslogdShutdown (Rule)

syslog daemon shutdown

Knowledge Base article:

Summary

This rule alerts on the status of the syslogd daemon running on the vSphere host.

Causes

The Syslog daemon (service) on this vSphere host has been stopped. This means that Syslog messages will no longer be forwarded to Ops Mgr.

Resolutions

Check the service status on the host. Note that this message may be received when a Syslogd restart is performed; so Syslogd may be running again and no resolution is required.

Use the Alerts View to see all current open issues for this object. Use the Events View to review any error and warning events for this object. Open a Performance View to see the performance metrics for this object and all contained objects. Open a Diagram View to analyse the relationships of this object to other components.

Additional

Syslog messages are not available via the Veeam Collector default method of connection to vCenter. The Veeam Collector receives Syslog messages direct from the vSphere host, via manual editing of the syslog.conf file on the host server. For details see the Veeam MP documentation.

External

See the Help Center for more information including reference lists of all Rules and Monitors and full set of User Guides for the Veeam MP for VMware.

See the VMware Online Documentation for more information on VMware vSphere, in particular:

Element properties:

TargetVeeam.Virt.Extensions.VMware.VMHOST.Syslog
CategoryEventCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityLow
RemotableTrue
Alert Message
Veeam vSphere Host Syslog: Syslog daemon service shutdown
{0}
Event LogVeeam VMware

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Veeam.Virt.Extensions.VMware.VMHOST.SyslogEvents.syslogdShutdown" Enabled="onEssentialMonitoring" Target="VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMHOST.Syslog" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>.</ComputerName>

      <LogName>Veeam VMware</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">900</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[5]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">$Target/Host/Property[Type="VeeamVEVMwareLib!Veeam.Virt.Extensions.VMware.VMHOST"]/id$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[11]</XPathQuery>

              </ValueExpression>

              <Operator>MatchesWildcard</Operator>

              <Pattern>syslogd shutdown succeeded</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Veeam.Virt.Extensions.VMware.VMHOST.SyslogEvents.syslogdShutdown.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>