VMware VSHIELD APP 1.0 Admin Manual page 85

Possible causes for events are listed in Table
Table 14-7. Possible Causes for Events
Code Event
0001 VSM_FSFD_EVENT_VERSION_MISMATCH
0003 VSM_FSFD_EVENT_DISK_FULL
0004 VSM_FSFD_EVENT_TIMEOUT
0005 VSM_FSFD_EVENT_UNKNOWN_STATE
0006 VSM_FSFD_EVENT_MISSING_TIMER
0007 VSM_FSFD_EVENT_TIMER_RESTORED
1000 VSM_VM_EVENT_CONNECTED
1001 VSM_VM_EVENT_DISCONNECTED
1002 VSM_VM_EVENT_UNKNOWN_STATE
N/A VM_POWERED_OFF
2000 VSM_SVM_EVENT_ENABLED
2001 VSM_SVM_EVENT_INIT_FAILURE
2003 VSM_SVM_EVENT_FSFD_FLOOD_DETECTED
2005 VSM_SVM_EVENT_DROPPED_EVENTS
2006 VSM_SVM_EVENT_MISSING_REPORT
2007 VSM_SVM_EVENT_REPORT_RESTORED
3000 VSM_HOST_EVENT_VERSION_MISMATCH
3002 VSM_HOST_EVENT_UNKNOWN_STATE
3003 VSM_HOST_EVENT_SVM_REGISTERED
3004 VSM_HOST_EVENT_SVM_UNREGISTERED
3005 VSM_HOST_EVENT_VMS_CONNECTED
3006 VSM_HOST_EVENT_VMS_DISCONNECTED
VMware, Inc.
14‐7:
Possible Cause
Compatible versions of the vShield Endpoint modules must be used. Please
refer to the vShield Endpoint Installation guide for a compatibility list.
The vShield Endpoint Thin Agent may need to write to a file on the local
disk for file remediation purposes, as well as for temporary storage. The file
location for the temporary files is: %SYSTEMROOT%\temp\vmware\eps010\
For remediation purposes, the needed storage is comparable to the size of
the file being remediated. It is recommended that local disks are at 95% or
less capacity. Running out of disk space may prevent vShield Endpoint from
functioning properly and from effectively protecting the affected VM.
VM is slow to respond to SVM requests. This may happen when the VM is
temporarily running low on CPU resources.
N/A
Thin agent is not operating properly.
N/A
VM configured for vShield Endpoint protection will generate this event
when loaded on the corresponding ESX host, for example, during power‐up
or incoming vMotion.
VM configured for vShield Endpoint protection will generate this event
when loaded on the corresponding ESX host, for example, during shutdown
or outgoing vMotion.
Heavy load of event reporting on the SVM, or a communication problem
between the SVM and the vShield Manager.
N/A
N/A
vShield Endpoint SVM component failed to initialize. Please consult partner
SVM installation documentation for causes.
The SVM is overloaded. The number of events exceeds the maximum
concurrent events threshold.
Heavy load of event reporting on the SVM, or communication problem
between the SVM and the vShield Manager.
1 Check SVM status.
2 Check network connection between vShield Manager and SVM.
N/A
Compatible versions of the vShield Endpoint modules must be used. Please
refer to the vShield Endpoint Installation guide for a compatibility list.
Heavy load of event reporting on the SVM, or communication problem
between the SVM and the vShield Manager.
N/A
N/A
N/A
N/A
Appendix 14 vShield Endpoint Events and Alarms
85