I have a user asking for a monitor/rule to alert for an error in VMware for Linux virtual machines ONLY. 

The error in VMware is "an error occured while saving a snapshot: msg.snapshot.error-QUIESCINGERROR."

1) I'm not sure if I should use a rule or a monitor for this alert?

2) How do I go about formulating an alert for this error in VMware for Linux virtual machines?

Thanks for your help.

I would just use a log file monitor if these errors are being generated in a log. If these errors are occurring only on VMware systems then it's pretty simple to just push the monitor out to all Linux systems monitored by SCOM and only the VMware ones should trigger it.

If that is not the case then you will need to create a collection in SCOM and add all VMware systems to the collection and push the monitor out to the collection.

If using a log file monitor the alert will be generated once it matches a pattern, something like 'an error occurred while saving a snapshot: msg.snapshot.error'. The alert will contain the matching line from the log and what system it came from.

Regards,

-Steve

Hi Steve

Can we actually put an agent on an ESX Host? If this alert is only exposed within the ESX Host then (I suspect) we'll need to leverage SNMP to do the monitoring. I don't think you will be able to discover the ESX Host as a Linux server as I don't believe it is a supported Linux OS. I would be very happy to be wrong ;-) 

http://www.scom2k7.com/monitoring-vmware-esx-using-a-scom/

Where does this error occur \ show? If you are "lucky" this is an alert that is dropped into an event log on the VMWare VCenter server (which is likely to be a windows box). If so, you can just use windows based monitoring. Leveraging the PowerCLI from scripts run against the VCenter server might be another option.

If you want to go more in depth VMWare monitoring then there are 3rd party solutions such as:

- Veeam

- OpsLogix

- Bridgeways

There are probably others. Best to evaluate them all against your requirements to find a balance between cost \ functionality that suits your needs.

Regards

Graham

Graham,

Nope, we don't support the agent running on the ESX host. I'm thinking specifically about a log generated by the VMs themselves running on the ESX host. If that is not an option then going the SNMP route or possibly forwarding the ESX logs (syslog) to a system that we can monitor with the SCOM agent and monitor that log.

Regards,

-Steve

Ah - understood. It would be useful if the original poster can confirm where this message is logged.

If it is surfaced in a log on windows VM guest then it is straight forward to create a class for VMWare virtual guest and target just that.

Similarly for if it is surfaced in a log (windows or text file) on a VCenter server then it is straight forward to create a class and monitor.

If we can run a PowerShell script (perhaps leveraging PowerCLI) then again, we can almost certainly do this from a windows server (most likely the VCenter Server).

If it is only surfaced on the ESX host then I suspect SNMP is the only likely solution (or possibly look at some 3rd party vendors such as OpsLogix, Veeam or Bridgeways) to see if their solutions cover this. 

Cheers

Graham