Alarms; Host Alarms; Svm Alarms - VMware VSHIELD APP 1.0.0 UPDATE 1 Admin Manual

vShield Administration Guide

Alarms

Alarms signal the vCenter Server administrator about vShield Endpoint events that require attention. Alarms
are automatically cancelled in case the alarm state is no longer present.
vCenter Server alarms can be displayed without a custom vSphere plug-in. See the vCenter Server
Administration Guide on events and alarms.
Upon registering as a vCenter Server extension, the vShield Manager defines the rules that create and remove
alarms, based on events coming from the three vShield Endpoint components: SVM, vShield Endpoint
module, and thin agent. Rules can be customized. For instructions on how to customize rules for alarms, see
the vCenter Server documentation. In some cases, there are multiple possible causes for the alarm. The tables
that follow list the possible causes and the corresponding actions you might want to take for remediation.
vShield Endpoint defines three sets of alarms:


"Host Alarms"



"SVM Alarms"


"VM Alarms"
Host Alarms
Host alarms are generated by events affecting the health status of the vShield Endpoint module.
Table 14-1. Warnings (Marked Yellow)
Possible Cause
SVM is registered, but vShield Endpoint
module does not see any virtual machines to
protect. No requests for protection are coming
from any virtual machines. No virtual machines
are currently protected.
Table 14-2. Errors (Marked Red)
Possible Cause
The SVM version is not compatible with the
vShield Endpoint module version.
SVM Alarms
SVM alarms are generated by events affecting the health status of the vShield Endpoint module.
Table 14-3. Red SVM Alarms
Problem
The vShield Monitor is not receiving status from
the SVM.
The SVM failed to initialize
80
on page 80
on page 80
on page 81
Action



Usually a transient state occurring while existing virtual
machines are being moved with vMotion, or are just coming up.
No action required.
The ESX host has no virtual machines yet, or only virtual
machines with non-supported operating systems. No action
required.
Check the vShield Manager console for the status of the virtual
machines that should be protected on that host. If one or more
have an error status, the Endpoint thin agents in those machines
may be malfunctioning.
Action
Install compatible components. Look in the vShield Endpoint
Installation Guide for compatible versions for vShield Endpoint
module and SVM.
Action
Either there are network issues between the vShield Monitor and the
SVM, or the SVM is not operating properly.
Contact your security provider for help with SVM errors.
VMware, Inc.