Chat now with support
Chat with Support

Change Auditor for VMWare 7.1 - Event Reference Guide

Introduction

Proper auditing and log management for your VMware vCenter Server infrastructure components are critical for security and compliance, but they can prove difficult in practice using native auditing tools. To facilitate the management of this, Change Auditor automatically monitors vital changes to VMware’s infrastructure, including datacenters, hosts, virtual machines and other resources associated with vCenter or ESX hosts.

Alerts will be raised to show the pertinent (who, where, what, and when) information and reports will be available to provide associated information.

* 
NOTE: An agent is required for the auditing of these events. Therefore activity done through cellular, mobile, or browser will not be captured as part of the auditing process.

This guide lists the events that can be captured by Change Auditor for VMware. Separate event reference guides are provided that list the core Change Auditor events (Change Auditor internal events, Custom Registry Monitoring, Fault Tolerance, Local Group Monitoring, Local User Monitoring, Service Monitoring, and System Events) and the events captured when the different auditing modules are licensed.

 

Change Auditor for VMware Events

This section lists the audited events captured by Change Auditor for VMware.

 
* 
IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.
* 
NOTE: To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the Change Auditor for VMware client. This page displays the facility to which the event belongs, the severity assigned to each event, and if the event is enabled or disabled.

VMware Account

 
 
Table 1. VMware Account event
Event
Description
Severity

Vim Account Password Changed

Created when the password for the Vim account on the host is changed.

NOTE: The Vim account is created by VirtualCenter and is used to manage the host.

High

VMware Alarm

 
 
Table 2. VMware Alarm events
Event
Description
Severity

Alarm Action Triggered

Created when an alarm is triggered.

Medium

Alarm Created

Created when an alarm is created.

Medium

Alarm Email Completed

Created when an alarm email notification is completed.

Medium

Alarm Email Failed

Created when an alarm email notification fails to complete.

High

Alarm Event

Created when an alarm event occurs.

Medium

Alarm Reconfigured

Created when an alarm is reconfigured.

Medium

Alarm Removed

Created when an alarm is removed.

Medium

Alarm Script Complete Event

Created when an alarm-triggered script is completed.

Low

Alarm Script Failed

Created when an alarm-triggered script fails to complete.

Medium

Alarm Snmp Completed

Created when an alarm SNMP notification is completed. (Disabled by default)

Medium

Alarm Snmp Failed

Created when an alarm SNMP notification fails to complete.

Medium

Alarm Status Changed

Created when the status of an alarm changes.

Medium

Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating