OpsMgr 2007 MP Authoring – Proxying Syslog Events

So, I have a windows server receiving ESXi syslog events. However, in my upcoming vCenter Management Pack I wanted events from each host to show up in that hosts’ Event View. Oh no, “it’s impossible!” they said. Poppycock, you just have to use a round-about method (or something simpler that I missed :).

Getting started:

  • I have a server named Win-Syslog, it’s receiving syslog events that show up under it’s Event View per this blog post:  Monitoring ESXi Syslogs with OpsMgr 2007 R2 (Part 1).
  • I have a new host class discovered via SNMP (or my unreleased vCenter MP).
  • Most of the scripts and examples reference my vCenter MP. It’s not done at all, and I can’t promise that it won’t destroy your universe if you import it into OpsMgr. However, so you can poke around to get Syslog Proxying wokring, you can dload the MP here: JPPacks vCenter MP. (Right-click, Save-As).

Custom Data Source

  • Create a custom DataSource with three modules:
    • DataSource: System.ApplicationLog.SysLog.FilteredEventProvider
    • Probe Action: Microsoft.Windows.PowerShellPropertyBagProbe
    • Condition Detection: System.Event.GenericDataMapper
  • The configuration for these should be the same as the post linked above, except that the PowerShell parse script needs to lookup the source ESXi host’s GUID in the OpsMgr database and insert it into the property bag as “CustomMonitoredObjectGUID”. Download and open my vCenter MP for my script. If you want to write this on your own, see my previous post about Looking Up Property GUIDs. Looking up an instance GUID is a similar process.

Custom Write-Action

  • Then, create a custom write-action with the following module:
    • Microsoft.Windows.PowerShellWriteAction
  • Download my vCenter MP for the script.

The Rule

  • Then, create a collection rule that uses these modules:
    • Data Sources: The custom DS made earlier.
    • Actions: The custom WA made earlier.

Once done, all syslog events should now flow from the source GUID of the ESXi host (found by DNS name, or however you configure the ParseScript. Sorry this is choppy and not really a stand-alone post. Developing this vCenter MP is so much fun that it’s giving my personal life quite a beating!

One thought on “OpsMgr 2007 MP Authoring – Proxying Syslog Events

  1. Pingback: Table of Contents | windowsmasher

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s