I have been working with vSphere to get internally generated Alarms an SNMP Trap for ticket generation. This process seemed simple on the surface but proved quite challenging. The high level steps are as follows:
- Choose which vCenter Alarms need to be ticketed
- Configure the Alarms to send SNMP events to SNMP trap
- Download the vSphere MIB and install in SNMP Trap
- Configure the Alarm actions on SNMP Trap
- Tickets get opened
Choose which vCenter Alarms need to be ticketed
You can get a list of current alarms with powercli as follows:
Get-AlarmDefinition
Configure Alarms to send SNMP
vCenter must be configured to use SNMP with the following lines:
$srv = vcenterservername
Get-AdvancedSetting –Entity $srv –Name snmp.receiver.2.community | Set-AdvancedSetting –Value public
Get-AdvancedSetting –Entity $srv –Name snmp.receiver.2.enabled | Set-AdvancedSetting –Value $true
Get-AdvancedSetting –Entity $srv –Name snmp.receiver.2.name | Set-AdvancedSetting –Value 192.168.1.10
The following will add SNMP to the alarms:
Get-AlarmDefinition -Name "Alarm1" | New-AlarmAction -Snmp
Configure the Alarm Action in SNMP Trap
I ran into a number of issues that generated this community post . The essential issue is that all SNMP events generated by vSphere come in as the same type of event vpxaAlarmInfo. The details of the event contains information an internal name. This is where the problem begins. The name for any custom created event is the name of the event. For example if I create a Alarm called JoeTest then it’s called JoeTest. Sounds simple right? Well… no because the VMware built in alarms don’t following this naming convention. The Host connection and power state (easiest one for me to generate) is named alarm.HostConnectionStateAlarm. Making my mappings for any VMware generated events very hard. So I went on a quest to locate these names.
The Quest for the names
My first stop was PowerCLI using the command:
$bob = Get-AlarmDefinition -Name "Host connection and power state"
$bob | fl
This fine powershell did not produce the alarm.HostConnectionStateAlarm name. It did produce a Alarm-145 (unique to my vCenter). I tried lots of ways to work on this object like get-view etc… without any luck.
My next stop was the MOB (Managed Object Browse) also known as my least favorite place. Using the following MOB I was able to learn everything about the alarm except the name for SNMP:
https://vcenter/mob/?moid=alarm-145
https://vcenter/mob/?moid=alarm-145&doPath=info
https://vcenter/mob/?moid=alarm-145&doPath=info.action.action
https://vcenter/mob/?moid=alarm-145&doPath=info.expression.expression
https://vcenter/mob/?moid=alarm-145&doPath=info.setting
This lead me to my last stop the vCenter database. Some finely crafted searches produced a number of tables with the alarm.xxx information. I was left with the VPX_EVENT_ARG table. It seems to be a table of all events in the system. Inside this I was able to locate names that seemed to fit. A few more minutes did not produce any primary keys to link to the Alarm tables. I was stuck so I punted. The following is a SQL command I used to produce the Alarms names:
select distinct OBJ_NAME from [vCenter].[dbo].[VPX_EVENT_ARG] where obj_name like ‘%alarm%’
It produced the following built in Alarm names:
alarm.BatteryHealthAlarm
alarm.BMCHealthAlarm
alarm.ConsistencyGroupViolation
alarm.DatastoreDiskUsageAlarm
alarm.DatastoreInMultipleDatacenters
alarm.DatastoreStorageComplianceAlarm
alarm.ExitStandbyErrorAlarm
alarm.FanHealthAlarm
alarm.HAcannotFindMaster
alarm.HAfailoverFailed
alarm.HAfailoverInProgress
alarm.HAhostStatus
alarm.HAinsufficientFailoverResources
alarm.HAvmMonitoringAction
alarm.HAvmMonitoringError
alarm.HealthStatusChangedAlarm
alarm.HostConnectionStateAlarm
alarm.HostConnectivityAlarm
alarm.HostCPUUsageAlarm
alarm.HostErrorAlarm
alarm.HostEsxCosSwapAlarm
alarm.HostLicenseEditionNotAllowed
alarm.HostMemoryUsageAlarm
alarm.HostVendorProviderRegistrationAlarm
alarm.IormNonVIWorkloadAlarm
alarm.LicenseCapacityExceededAlarm
alarm.LicenseError
alarm.LicenseNonComplianceAlarm
alarm.LicenseUserThresholdExceededAlarm
alarm.LunCapabilityAlarm
alarm.MemoryHealthAlarm
alarm.MigrateBindToVMKAlarm
alarm.MigrationErrorAlarm
alarm.NetworkConnectivityLostAlarm
alarm.NetworkRedundancyDegradedAlarm
alarm.NetworkRedundancyLostAlarm
alarm.OtherHealthAlarm
alarm.PowerHealthAlarm
alarm.ProcessorHealthAlarm
alarm.SELHealthAlarm
alarm.SiocNotSupportedHostAlarm
alarm.StorageConnectivityAlarm
alarm.StorageHealthAlarm
alarm.StoragePodOutOfSpace
alarm.StoragePodSDRSNotSupportedHost
alarm.StoragePodSDSRecommendation
alarm.SystemBoardHealthAlarm
alarm.TemperatureHealthAlarm
alarm.ThinProvisionedLunAlarm
alarm.VCHealthStateChangedAlarm
alarm.VdsHCMTUMatchAlarm
alarm.VdsHCMTUSupportedAlarm
alarm.VdsHCTeamingMatchAlarm
alarm.VdsHCVlanTrunkedAlarm
alarm.VFlashResourceHealthAlarm
alarm.VFlashResourceUsageAlarm
alarm.VmCPUUsageAlarm
alarm.VmDiskConsolidationNeededAlarm
alarm.VmErrorAlarm
alarm.VmFaultToleranceLatencyStatusAlarm
alarm.VmFaultToleranceStateChangedAlarm
alarm.VmMemoryUsageAlarm
alarm.VmNoCompatibleHostForSecondaryAlarm
alarm.VmStorageComplianceAlarm
alarm.VmTimedoutStartingSecondaryAlarm
alarm.VoltageHealthAlarm
alarm.VsanClusterLicenseExpiryAlarm
alarm.VsanHostSsdOverUsageAlarm
Testing two additional events confirmed I was on the correct track.
End Result
Yep I don’t have a clue how they link but it produced a list that seems to work and I it. I hope it helps you save some time.