Veeam One 9 5 Alarms Guide PDF

Veeam ONE
Version 9.5
Working with Alarms

March, 2017
2017 Veeam Software.
All rights reserved. All trademarks are the property of their respective owners.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system,
or translated into any language in any form by any means, without written permission from Veeam
Software (Veeam). The information contained in this document represents the current view of Veeam
on the issue discussed as of the date of publication and is subject to change without notice. Veeam
shall not be liable for technical or editorial errors or omissions contained herein. Veeam makes no
warranties, express or implied, in this document. Veeam may have patents, patent applications,
trademark, copyright, or other intellectual property rights covering the subject matter of this
document. All other trademarks mentioned herein are the property of their respective owners. Except
as expressly provided in any written license agreement from Veeam, the furnishing of this document
does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Important! Please read the End User Software License Agreement before using the accompanying software
program(s). Using any part of the software indicates that you accept the terms of the End User
Software License Agreement.
2 | Veeam ONE | Working with Alarms | REV 4

CONTENTS
CONTENTS............................................................................................................................................ 3
CONTACTING VEEAM SOFTWARE....................................................................................................... 5
ABOUT THIS DOCUMENT .................................................................................................................... 6
ABOUT ALARMS ................................................................................................................................... 7
HOW ALARMS WORK ........................................................................................................................................................... 8
ALARM RULES ....................................................................................................................................................................... 9
ALARM SEVERITY ................................................................................................................................................................10
ALARM ASSIGNMENT OPTIONS .........................................................................................................................................11
ALARM RESPONSE ACTIONS ..............................................................................................................................................12
ADVANCED ALARM OPTIONS ............................................................................................................................................13
ALARM REPORTS ................................................................................................................................................................14
CONFIGURING ALARMS .................................................................................................................... 15
CREATING ALARMS.............................................................................................................................................................16
MODIFYING ALARMS..........................................................................................................................................................33
Adding Alarm Rule from Task or Event ................................................................................................. 34
Adding Alarm Rules from Performance Counters ............................................................................ 35
CHANGING ALARM ASSIGNMENT SCOPE .........................................................................................................................36
Modifying Alarm Assignment Scope ..................................................................................................... 37
Excluding Single Objects from Alarm Assignment Scope ............................................................ 39
Excluding Multiple Objects from Alarm Assignment Scope ........................................................ 40
Excluding Objects from Multiple Alarms ............................................................................................. 42
Viewing Alarm Exclusions .......................................................................................................................... 44
COPYING ALARMS ..............................................................................................................................................................45
DISABLING AND ENABLING ALARMS.................................................................................................................................46
DELETING ALARMS .............................................................................................................................................................47
EXPORTING AND IMPORTING ALARMS ..............................................................................................................................48
SUPPRESSING ALARMS .......................................................................................................................................................50
Maintenance Mode ...................................................................................................................................... 51
Alarm-Specific Suppression Settings..................................................................................................... 54
Suppressing Guest Disk Space Alarms .................................................................................................. 55
MODELLING ALARM NUMBER ...........................................................................................................................................56
CONFIGURING ALARM NOTIFICATIONS ............................................................................................................................58
Email Notifications ........................................................................................................................................ 59
SNMP Traps ...................................................................................................................................................... 74
EXAMPLES: HOW TO CREATE ALARMS .............................................................................................................................78
WORKING WITH TRIGGERED ALARMS .............................................................................................. 84
VIEWING TRIGGERED ALARMS ...........................................................................................................................................85
RESOLVING ALARMS...........................................................................................................................................................87
Resolving Individual Alarms ...................................................................................................................... 88
Resolving Multiple Alarms ......................................................................................................................... 89
Notifications on Resolved Alarms ........................................................................................................... 90
ACKNOWLEDGING ALARMS ...............................................................................................................................................91
Acknowledging Individual Alarms ......................................................................................................... 92

Acknowledging Multiple Alarms............................................................................................................. 93
Notifications on Acknowledged Alarms............................................................................................... 94
VIEWING ALARM HISTORY .................................................................................................................................................95
EXPORTING TRIGGERED ALARMS ......................................................................................................................................96
WORKING WITH INTERNAL ALARMS ................................................................................................ 97
VIEWING INTERNAL ALARMS .............................................................................................................................................98
CONFIGURING INTERNAL ALARMS ....................................................................................................................................99
APPENDIX A. ALARMS ..................................................................................................................... 100
Veeam Backup & Replication Alarms ................................................................................................... 100
Internal Alarms and Events...................................................................................................................... 105
Veeam Backup & Replication Alarms and Events ........................................................................... 108
VMware vSphere Alarms .......................................................................................................................... 113
Microsoft Hyper-V Alarms ........................................................................................................................ 136
Internal Alarms ............................................................................................................................................. 152
APPENDIX B. ALARM RULES ........................................................................................................................................... 155
Alarm Rules for VMware vSphere ......................................................................................................... 155
Alarm Rules for Microsoft Hyper-V ....................................................................................................... 160
Alarm Rules for Veeam Backup & Replication .................................................................................. 163

CONTACTING VEEAM SOFTWARE
At Veeam Software we value the feedback from our customers. It is important not only to help you
quickly with your technical issues, but it is our mission to listen to your input, and build products that
incorporate your suggestions.
Customer Support
Should you have a technical concern, suggestion or question, please visit our Customer Center Portal
at www.veeam.com/support.html to open a case, search our knowledge base, reference
documentation, manage your license or obtain the latest product release.
Company Contacts
For the most up to date information about company contacts and offices location, please visit
www.veeam.com/contacts.html.
Online Support
If you have any questions about Veeam ONE, you can use the following resources:
Full documentation set: www.veeam.com/documentation-guides-datasheets.html
Community forum at forums.veeam.com

ABOUT THIS DOCUMENT
This document describes how to work with Veeam ONE alarms for Veeam Backup & Replication,
VMware vSphere and Microsoft Hyper-V infrastructures. It provides instructions on configuring alarms,
enabling alarm notifications and working with triggered alarms in Veeam ONE Monitor.
Intended Audience
The guide is designed for anyone who plans to use the Veeam ONE solution. It is primarily aimed at
administrators managing Veeam Backup & Replication, VMware vSphere and Microsoft Hyper-V
environments, but can also be helpful for other current and perspective Veeam ONE users.
Document Revision History

Revision # Date Change Summary
Revision 1 11/16/2016 Initial version of the document for Veeam ONE 9.5.
Revision 2 12/30/2016 Added sections VMware vSphere Alarms and Microsoft Hyper-V Alarms.
Document updated for Veeam ONE 9.5 Update 1.

Revision 3 1/17/2017
Added note about objects to exclude in section Adding State-Based Rules.
Revision 4 3/14/2017 Updated Step 1 in section SNMP Traps.

ABOUT ALARMS
Veeam ONE alarms notify users about important events, changes and potential problems in the
managed virtual and backup environment. Alarms speed up the process of identifying,
troubleshooting and reacting to issues that may affect mission critical services and business
operations.
Out of the box, Veeam ONE comes with a set of predefined alarms so that you can start monitoring
your environment immediately after installing the solution. Predefined alarms include:
VMware vSphere and vCloud Director alarms
Microsoft Hyper-V alarms
Veeam Backup & Replication alarms
Internal alarms for monitoring issues with Veeam ONE
Predefined alarms are based on best practices and include an extensive knowledge base. When a
problem occurs, you will not only be alerted, but will also have all the necessary information for
troubleshooting and finding the root cause of the issue.
Veeam ONE offers an extensive set of tools that will help you develop your own alarm model.
Depending on your requirements to the virtual and backup environment, you can customize
predefined alarms, or create new alarms. This section describes various aspects of alarms in Veeam
ONE, including alarm rules, severity levels, assignment options, response actions and other.

How Alarms Work
After you connect virtual or backup servers, Veeam ONE Monitor starts collecting data about objects
in your environment and their health state, and checks this data against alarm configuration in real
time. If Veeam ONE Monitor detects that behavior or state of an infrastructure object meets alarm
criteria, or that a specific event occurs, it triggers an alarm with the corresponding severity level.
After an alarm is triggered, Veeam ONE Monitor console will display alarm details and information
about the affected object. You can view, acknowledge or resolve the alarm. If an alarm is configured to
perform some action, Veeam ONE Monitor performs a response action after the alarm is triggered
sends an email notification, SNMP trap or runs a custom script.
If the event, state or condition that triggered the alarm is resolved, Veeam ONE Monitor updates the
alarm status in the console.

Alarm Rules
Every alarm has one or more associated rules that define conditions to trigger the alarm, severity of
the alarm and rule suppression settings.
There are two types of alarm rules:
Event-based rules are rules for alerting about specific events that occur in the backup or
virtual infrastructure. These can be events issued by the hypervisor or Veeam Backup &
Replication events.
Rules for a specific condition or state are rules for alerting about an important condition or
changed state of infrastructure objects.
For the full list of available rule types, see Appendix B. Alarm Rules.
Linking Rules
One alarm can include up to 8 rules. You can link two or more rules with the help of Boolean
operators:
AND if rules are joined with this operator, an alarm is triggered when conditions for all
linked rules are met.
OR if rules are joined with this operator, an alarm is triggered when a condition for any of
the linked rules is met.
You can form several groups of linked rules and join them with different operators. To learn how to
link rules, see Step 3. Specify Alarm Rule(s) and Severity.

Alarm Severity
Every alarm rule is associated with a specific severity level. The severity level defines how serious the
state or event is and how badly it can affect an object health state.
There are 4 severity levels that are color-coded as follows:
Error (red) indicates a critical situation or a major problem that requires immediate action.
Warning (yellow) indicates a potential problem or non-critical issue that needs your
attention. If the issue is left without attention, it can potentially cause a major problem.
Resolved (green) indicates that the issue was eliminated because of the changed conditions,
or shows that the alarm was resolved manually.
Information (blue) indicates general information about a specific condition or health state of
an object.
You can define different severity levels for conditions of different intensity. For example, if the level of
memory usage must not exceed 75%, you can create the following alarm rules:
If the memory usage is over 70%, an alarm with the Warning severity level must be triggered.
If the memory usage is over 75%, an alarm with the Error severity level must be triggered.
In such situation, if the memory usage level is constantly growing and exceeds 70%, Veeam ONE will
trigger a warning alarm, notifying about a potentially dangerous situation. If the memory usage level
keeps on growing and exceeds the level of 75%, Veeam ONE will trigger an error alarm notifying
about severe danger.

Alarm Assignment Options
Veeam ONE alarms are assigned to objects of the backup or virtual infrastructure. There are several
options for assigning alarms:
Object-level assignment you can assign an alarm to a single object.
This type of assignment can be useful if you need to customize alarms for specific objects, like
separate hosts, VMs or backup infrastructure components.
Group-level assignment you can assign an alarm to a group of objects (for example, to an
infrastructure container or Veeam ONE Business View group).
This type of assignment can be useful if you need to assign an alarm to all objects under a
specific parent entity, for example, to all VMs residing on a host or to all backup proxies
connected to a backup server.
Infrastructure-level assignment you can assign an alarm to all objects of a particular type
in the entire managed environment.
This is the default type of assignment used for all predefined alarms.
You can combine various assignment options. For example, an alarm can be assigned to all VMs
running on a chosen host, to all VMs in a Veeam ONE Business View group and to a few single VMs at
the same time.
In addition to flexible alarm assignment options, Veeam ONE offers a possibility to exclude specific
objects or object groups from the assignment scope. Thus, you can easily point out what part of your
environment the alarm must disregard.

Alarm Response Actions
Every alarm performs a specific action when it gets triggered. Depending on its configuration, an
alarm can:
Send email notifications to the default notification group or to specific recipients
Send SNMP traps to third-party consoles
Run a custom script
Perform two or all of these actions at once
Alarm actions are defined in alarm settings. You can specify in which cases Veeam ONE must perform
response actions:
Alarm severity changes to Error
Alarm severity changes to Error or Warning
Alarm severity changes to any level (Error, Warning or Info)
By default, all predefined alarms are configured to send email notifications to the default notification
group when the alarm severity changes from one level to another. You can change alarm actions and
define conditions when these actions should be performed.

Advanced Alarm Options
To avoid alarm storms and ensure that critical issues are not overlooked, you can use advanced alarm
configuration options alarm suppressing and alarm modelling.
Alarm suppressing is used to disregard events and prevent sending alarms when specific
activities are performed. For example, during backup Veeam ONE may send a great number
of alarms informing about potential problems or increased resource pressure. Alarms
suppressing allows you to 'switch off' alarms during such activities, or at a specific period of
time, when resource-consuming operations are performed.
Alarms modelling is used to verify the created alarm scheme and estimate the need of
adjusting alarm settings. During alarm modelling, Veeam ONE applies alarm settings to
collected historical data and produces a forecast how many alarms will be sent over a specific
period of time. If the number of alarms is too high, alarm thresholds may need to be changed
to avoid numerous useless alarms. If the number is too low, the alarms sensitivity may need
to be increased not to miss important issues.

Alarm Reports
In addition to receiving alarms in real-time, Veeam ONE allows you to analyze alarm statistics. You can
use Veeam ONE Reporter dashboards and reports to track how the number of alarms was changing
over time, identify short- and long-term alarm trends, detect the most affected infrastructure objects,
troubleshoot commonly encountered issues and ensure that your infrastructure stays fully reliable
and productive.
You can use the following dashboards and reports for analyzing alarms:
Alarms Dashboard analyzes alarms triggered over the previous week. The dashboard
provides information on the general health state of virtual infrastructure objects, shows daily
roll-ups for errors and warnings, enumerates typical problems and helps detect the most
affected VMs, clusters, hosts and datastores/storages.
Alarms Overview Report provides an overview of the current health state of the virtual
infrastructure, details the most common alarms and identifies the most affected
infrastructure objects. The report consolidates information about raised alarms and provides
a summary for the selected time interval.
Alarms Current State Overview Report provides information about all currently unresolved
alarms, that is alarms with the Error or Warning severity level, and displays reasons why these
alarms were triggered.
For details on Veeam ONE reports and dashboards, see Veeam ONE Reporter Guide.

CONFIGURING ALARMS
Veeam ONE comes with a set of predefined alarms so that you can start monitoring your environment
immediately after installing the solution. You can leave alarm defaults without changes, you can
customize predefined alarms, or create new alarms for specific monitoring conditions.
To access the list of alarms:
1. Open Veeam ONE Monitor.
2. At the bottom of the inventory pane, click Alarm Management.
3. To limit the list of displayed alarms, you can use filter buttons Show predefined alarms only,
Show custom alarms only, All.
The Alarm Management view is divided into three panes inventory pane, information pane and
actions pane.
The inventory pane on the left shows the alarm management tree with alarm types (virtual
infrastructure components to which alarms can be applied, vCloud Director components,
Veeam Backup & Replication infrastructure components and internal alarms).
The information pane contains the list of predefined and custom alarms for the type that is
selected in the alarm management tree. Every alarm is described with the following details:
type, name, source, state (Enabled or Disabled), assignment scope and resolve action
(Automatic or Manual). The bottom section of the information pane displays alarm knowledge
base information on the selected alarm, such as summary, cause, resolution and external
resources.
The Actions pane on the right displays a list of links for performing alarm actions.

Creating Alarms
If predefined alarms do not cover all important events, conditions or state changes about which you
need to be notified, you can create custom alarms.
To create a new alarm, perform the following steps.
Step 1. Select Alarm Type

All alarms are applied to a certain level of the virtual, vCloud Director or backup infrastructure. The
Type attribute of an alarm defines to what kind of infrastructure objects this alarm applies. The list of
available alarm types is displayed in the inventory pane of the Alarm Management view.
To create a new alarm, select its type first:
3. In the alarm management tree, select the necessary object type.
4. In the Actions pane on the right, click the New link.
You can also right-click anywhere in the information pane and choose New from the shortcut
menu.
Creating Alarms from Tasks or Events

You can create an alarm that is based on an occurred task or event:
2. Choose the necessary view Infrastructure view, vCloud Director View, Business View or
Data Protection View.
3. Open the Tasks & Events tab of the information pane for a target object.
4. Right-click a task or event in the list, choose Create new alarm from the shortcut menu and
then choose an object type.
Creating Alarms from Performance Chart Counters

You can create an alarm from a performance counter:
2. Choose the necessary view Infrastructure view, vCloud Director View, Business View or
Data Protection View.
3. Open a tab with performance parameters for which you want to create an alarm (for example,
Network, Memory, CPU, etc.).
4. At the bottom of the performance chart, right-click the necessary counter and choose Create
new alarm from the shortcut menu.

Step 2. Specify General Alarm Settings
On the General tab of the Alarm settings window, specify general alarm settings:
1. In the Alarm name field, enter the name of the new alarm.
2. Select the Enable this alarm check box if you want to enable the alarm immediately after
you save its settings.
If the check box is not selected, the alarm settings will be saved, but the alarm will be
disabled and will not raise any notifications.
Note that at this point, the alarm type cannot be changed.

Step 3. Specify Alarm Rules and Severity
On the Rules tab of the Alarm settings window, specify rules for triggering the alarm.
There are two types of rules state or condition-based rules, and event-based rules. You can add up
to 8 rules of different type to one alarm and link them.
Adding State-Based Rules

Alarms with state or condition-based rules alert about an important condition or state change.
To add a rule for a specific condition or state change:
1. On the Rules tab, click Add.
2. At the Choose Rule Type step of the wizard, choose the Rule for specific conditions or
state trigger type.
3. Click Next, and select the necessary rule condition. Available options depend on an alarm
type.
4. At the Define Rule step of the wizard, specify conditions (or other settings, as applicable) for
the alarm rule and the alarm severity.
5. [Optional] Exclude specific objects from the alarm scope.
Some state-based rules can include storage counters (such as virtual storage, datastore,
VSAN). By default, such rules will apply to all storage objects in the alarm scope. For example,
if you create an alarm rule for a host and select a datastore usage counter, this rule will apply
to all datastores connected to the host.
You can exclude specific storage objects from the alarm scope. Excluded objects will not be
monitored by the alarm. To exclude one or more storage objects, specify their names in the
Exclude instances field. Separate object names with semicolon (;).
Note: 1. When you specify objects to exclude, use object display names. To learn an exact object
display name, navigate to a performance chart for the necessary object in Veeam ONE
Monitor, and choose a chart view with the necessary counter. You can check the object
display name either in the chart legend or in the Select Devices and Counters window >
Devices list. For details, see Veeam ONE Monitor Guide, section Selecting Chart Views and
Performance Counters.
2. Names of drives must be specified with the backward slash, for example, C:\; Z:\.
6. Specify alarm severity.

For more information on alarm severity, see Alarm Severity.
7. Select the Enable this rule check box if you want to put the rule in action for the alarm.
If the check box is not selected, the rule settings will be saved, but the rule will be
disregarded.
8. Click Finish.

Adding Event-Based Rules
Alarms with event-based rules alert about specific events that occur in your backup or virtual
infrastructure. These can be events issued by the hypervisor or Veeam Backup & Replication events.
To add an event-based rule:
1. On the Rules tab, click Add.
2. At the Choose Rule Type step of the wizard, select Event based rule.
3. At the Define Rule step of the wizard, specify rule settings:
a. In the Event name field, specify an event that must trigger an alarm.
For a list of Veeam Backup & Replication events, see section Appendix A. Alarms.
For a list of virtual infrastructure events, see VMware vSphere Documentation or
Microsoft TechNet library.
b. In the Event text field, specify one or more key words that an event description
must contain. This can be name of a user who initiated an action, name of a
changed object, or a specific action.
You can use * (asterisk) and ? (question) wildcards in the Event name and Event
text fields. The * (asterisk) character stands for zero or more characters. The ?
(question mark) stands for a single character.
For example, if you want to want to receive notifications when users reconfigure
VMs on the host.domain.local host, in the Event name field, specify
VmReconfiguredEvent, and in the Event text field, specify reconfigured * on
host.domain.local. Here the * (asterisk) replaces a name of a reconfigured VM. As a
result, the alarm will be triggered each time any user reconfigures any VM on the
host.
c. Specify the alarm severity.
For more information on alarm severity, see Alarm Severity.
d. In the Ignore after field, enter the number of times the alarm will be triggered
before all further repetitive alarms are suppressed.
For example, an alarm is configured to fire when a host loses its network
connection, and the Ignore after value is set to 1. If a host loses its network
connection, an event informing about connection loss will be raised by the
hypervisor, and Veeam ONE will trigger an alarm. All further events informing about
problems with host network connectivity will be ignored until you resolve the
alarm that has already been triggered.
By default, this value is set to 1.
e. In the Trigger after field, enter the number of times an event must repeat before
Veeam ONE must trigger an alarm.
By default, this value is set to 0, which means that Veeam ONE must trigger an
alarm after the first event occurrence.
f. Select the Enable this rule check box if you want to put the rule in action for the
alarm.
If the check box is not selected, the rule settings will be saved, but the rule will be
disregarded.

4. Click Finish.

Linking Rules
If you add multiple rules to one alarm, Veeam ONE will trigger an alarm when conditions for at least
one rule are met. You can change the default way of evaluating alarm rules and link rules using
Boolean AND or OR operators. For example, if an alarm must be triggered when conditions for two
rules are met simultaneously, you can link these rules with Boolean AND.
To link alarm rules:
1. Make sure that rules you want to link follow one another in the list. You cannot link rules that
do not follow one another. For example, you cannot link the first and the fifth rule.
To move a rule one position up, select the check box next to the rule and click Move up. To
move a rule one position down, select the check box next to the rule and click Move down.
2. Select check boxes next to rules you want to link, and click Link on the right.
3. In the Rule condition window, select a condition:
AND if rules are linked with this operator, an alarm is triggered when conditions
for all linked rules are met.
OR if rules are linked with this operator, an alarm is triggered when a condition
for any of the linked rules is met.
4. Click Apply.
After you link two or more rules, Veeam ONE will display a dotted line and a linking condition
between the rules.

To unlink rules:
1. Select the check box next to linked rules.
2. On the right, click Unlink.
When you unlink rules, you cancel a custom condition so that an alarm will be triggered each time
conditions for any alarm rule are met.

Removing Rules
To remove a rule from an alarm:
1. Select the check box next to a rule you want to remove.
2. On the right, click Remove.

Step 4. Specify Alarm Assignment
On the Assignment tab of the Alarm settings window, specify one or more infrastructure objects to
which the alarm must be assigned.
Adding Objects to Alarm Assignment Scope

To add one or more objects to alarm assignment scope:
1. On the Assignment tab, in the Assignment for alarm section, click Add.
2. From the list, select the necessary node Infrastructure tree, Business View, vCloud Director
View or Data Protection.
3. In the Assign Alarm window, select check boxes next to objects to which you want to assign
the alarm.
4. Click Assign.

To remove an object from the alarm assignment:
1. On the Assignment tab, in the Assignment for alarm section, select an object you want to
remove from the assignment.
2. On the right, click Remove.

Excluding Objects from Alarm Assignment Scope
You can exclude specific objects from alarm assignment scope:
1. On the Assignment tab, in the Excluded objects section, click Add.
2. From the list, select the necessary node Infrastructure tree, Business View, vCloud Director
View or Data Protection View.
3. In the Exclude Alarm window, select check boxes next to objects you want to exclude from
alarm assignment.
4. Click Exclude.

Step 5. Specify Alarm Actions
On the Actions tab of the Alarm settings window, specify what actions must be performed after the
alarm is triggered, or after the alarm status changes. You can choose to notify virtual infrastructure
administrators by email, send SNMP traps or run a custom script.
Note: To be able to receive email and trap notifications, you must first configure mail and trap notification
settings in the Veeam ONE Monitor Configuration Wizard or in Veeam ONE Monitor server settings.
To learn how to configure notification settings for alarms, see Configuring Alarm Notification
Settings.
To define alarm response actions:

1. From the Action list, select the necessary action:
Send email to a default group is the default action that applies to all new and
predefined alarms. Select this option if you want to send an email notification to all
recipients included in the default email notification group when the alarm is
triggered or when the alarm status changes.
For more information see Email Notifications.
Send email notification select this option if you want to send an email
notification to specific recipients when the alarm is triggered or when the alarm
status changes. In the Value field, enter recipients email addresses. If you want to
specify several recipients, separate email addresses with semicolon (;), comma (,) or
space ( ).
For more information see Email Notifications.
Send SNMP trap select this option if you want to send a Simple Network
Management Protocol (SNMP) trap when the alarm is triggered or when the alarm
status changes.
For more information, see SNMP Traps.
Run script select this option if you want to run a custom script when the alarm is
triggered or when the alarm status changes. By running a script, you can automate
routine tasks that are normally performed when specific alarms fire. For example, if
a critical system is affected, you may need to immediately open a ticket with the in-
house support or perform some corrective actions that will eliminate the problem.
In the Value field, enter the path to the executable file. The executable file must be
located on the machine running the Veeam ONE Server component. You can use
the following parameters in the command line for running the script: %1 alarm
name; %2 affected node name; %3 alarm summary; %4 time; %5 alarm
status; %6 old alarm status.
2. In the Condition field, describe when the action must be performed:
Errors and warnings select this option if the action must be performed every
time when the alarm status changes to Error or Warning.
Errors only select this option if the action must be performed every time when
the alarm status changes to Error.
Any state select this option if the action must be performed every time when
the alarm status changes to Error, Warning or Info.
You can specify multiple response actions for the same alarm. To add a new action, click the Add
button and repeat steps 1-2 for every new action.

Step 6. Configure Alarm Suppression Settings
In some cases, you might need to suppress alarms that occur under specific conditions or during a
specific time interval. For example, alarms informing about high resource utilization may need to be
suppressed if these alarms occur during a scheduled resource consuming operation (such as backup
performed with Veeam Backup & Replication or other operations).
For suppressed alarms, Veeam ONE does not show any notifications and does not perform any
response actions. If, by the end of suppression period, the object stays affected, Veeam ONE will
trigger the alarm with the corresponding severity and will perform the alarm response actions.
On the Suppress tab of the Alarm settings window, specify alarm suppression settings.
Suppressing Alarm During Events

To suppress the alarm under specific conditions or when a specific event occurs, choose one of the
following options:
Veeam Backup activity suppresses the alarm when Veeam backup and replication jobs
are running. Veeam ONE detects the beginning and the end of jobs and does not trigger the
alarm while the jobs are running.
For example, if you select Veeam Backup activity check box for the VM CPU Usage alarm, this
alarm will be suppressed for all VMs that are being backed up or replicated until the jobs
are finished.
If you select the Veeam Backup activity check box for the Host CPU Usage alarm, this alarm
will be suppressed for the entire host where at least one VM is being backed up or replicated
until the jobs are finished.
Snapshot creation suppresses the alarm during snapshot creation for the object itself or
its parent objects.
For example, if you create an alarm for a VM, the alarm will be suppressed for a VM while a
snapshot is being created. If you create an alarm for a host, the alarm will be suppressed for
the host while a snapshot is being created for any VM on this host.
Snapshot deletion suppresses the alarm during snapshot deletion for the object itself or
its parent objects.
For example, if you create an alarm for a VM, the alarm will be suppressed for a VM while a
snapshot is being deleted. If you create an alarm for a host, the alarm will be suppressed for
the host while a snapshot is being deleted for any VM on this host.
Note: 1. To enable the Veeam Backup activity option, make sure that you connected a Veeam Backup &
Replication server to Veeam ONE. Otherwise, alarms will not be suppressed during Veeam Backup
activity.
2. Snapshot creation and Snapshot deletion suppression options apply to VMware vSphere alarms
only.

Scheduled Alarm Suppression
To suppress the alarm according to a specific schedule during the week:
1. Select the Suppress alarm based on schedule option.
2. Specify time intervals on specific weekdays during which the alarm must be suppressed.
You can add more than one record for one weekday. Note that the time intervals specified for the
same day must not intersect.

Step 7. Specify Alarm Details
On the Knowledge base tab of the Alarm settings window, specify alarm details. Alarm details are
displayed when you select the alarm in the Alarm Management view or on the Alarms monitoring
dashboard in Veeam ONE Monitor, and included in alarm email notifications.
1. In the Knowledge, Cause and Resolution fields, specify alarm details, what could cause the
alarm and steps to resolve the alarm.
2. In the External field, provide links to external resources containing reference information,
such as VMware vSphere Documentation or Microsoft TechNet Library.
3. In the Custom field, specify additional information, such as comments of additional
instructions.
Step 8. Save Alarm Settings

Review the specified alarm settings, click OK to save the alarm.

Modifying Alarms
You can modify settings of a predefined or a custom alarm:
3. Select an alarm in the list and do one of the following:
Double click the alarm.
Right-click the alarm and choose Edit from the shortcut menu.
In the Actions pane, click Edit.
4. Change the necessary alarm settings.
For details on working with alarm settings, see Creating Alarms.
Other Ways to Modify Alarms

You can also modify alarms on the Alarms tab of the Infrastructure View, Business View, vCloud
Director View or Data Protection View.
2. At the bottom of the inventory pane, click the necessary view Infrastructure View, Business
View, vCloud Director View or Data Protection View.
3. In the inventory pane, select the necessary infrastructure object.
4. In the information pane, open the Alarms tab.
5. To open the Alarm settings window, do one of the following:
Right-click the alarm and choose Edit alarm from the shortcut menu.
Select the alarm in the list and click Edit alarm in the Actions pane on the right.
Modifying Multiple Alarms

Veeam ONE supports batch alarm editing. In the batch editing mode, you can change only the
Actions and Suppression alarm settings.
To modify settings of several alarms in batch:
3. Select the necessary alarms in the list using the [CTRL] or [SHIFT] key on the keyboard and
do one of the following:
Right-click the selection and choose Edit from the shortcut menu.
Click Edit in the Actions pane on the right.
4. Change the actions or suppression settings.

Adding Alarm Rule from Task or Event
You can to an alarm a new rule based on a task or event that occurred in the managed environment.
For example, you can create a rule that monitors the event Create virtual machine and notifies you
whenever a new VM is created.
To create a new rule from a task or event:
3. In the inventory pane on the left, select the necessary object.
4. In the information pane, open the Tasks & Events tab.
5. Right-click a task or event about which you want to be notified, select Add this even to the
existing alarm from the shortcut menu, and choose the necessary infrastructure object type.
6. In the Select Alarms window, choose an alarm to which the rule must be added and click
Add.
7. In the Alarm Settings window, change the rule settings, and click Save.
For details on working with alarm rules, see Step 3. Specify Alarm Rules and Severity.
8. In the Select Alarms window, click Close.

Adding Alarm Rules from Performance Counters
You can add to an alarm a new rule based on a performance counter.
Note: You can use this option with objects for which Veeam ONE collects performance data. For objects
that do not have any performance data, such as datacenters and clusters, this option is not available.
To create a new rule from a performance counter:

3. In the inventory pane on the left, select the necessary object.
4. Open a tab with performance parameters for which you want to create an alarm (for example,
Network, Memory, CPU, etc.).
5. At the bottom of the performance chart, right-click the necessary counter and choose Add
this counter to the existing alarm from the shortcut menu.
6. In the Select Alarms window, choose an alarm to which the rule must be added and click
Add.
7. In the Alarm Settings window, change the rule settings, and click Save.
For details on working with alarm rules, see Step 3. Specify Alarm Rules and Severity.
8. In the Select Alarms window, click Close.

Changing Alarm Assignment Scope
By default, all predefined alarms are assigned to the root level of the managed infrastructure. Alarms
for monitoring the virtual environment apply to the root level of the virtual infrastructure (connected
vCenter Server, SCVMM, failover cluster of host), vCloud Director alarms apply to the root vCloud
Director level and Veeam Backup & Replication alarms apply to the root level of the backup
infrastructure (connected backup server or Veeam Backup Enterprise Manager).
You can change the alarm assignment scope for predefined and custom alarms, exclude one or more
objects from the alarm scope, or even exclude an object from the scope of multiple alarms at once.

Modifying Alarm Assignment Scope
To modify assignment scope of one or more alarms:
3. In the alarm management tree, select the necessary type of infrastructure objects.
4. Select one or more alarms in the list and do one of the following:
Right-click the alarm and choose Edit assignment from the shortcut menu.
In the Actions pane on the right, click Edit assignment.
5. In the Edit assignment window, select the effective assignment rules and click Remove.
6. Click Add and choose one of the following options:
Infrastructure tree choose this option if you want to assign the alarm to a
specific level of the virtual infrastructure.
You can select infrastructure objects that match the alarm type or choose
containers from the virtual infrastructure hierarchy. For example, you can assign an
alarm of the Virtual Machine type to a specific VM, resource pool, host, cluster,
datacenter or vCenter Server or SCVMM server.
Business View choose this option if you want to assign the alarm to custom
categorization groups that you have configured in Veeam ONE Business View.
For example, if VMs in your environment are divided into SLA groups, you can
create a set of alarms that correspond to specific service level requirements and
assign these alarms to the necessary SLA group.
vCloud Director View choose this option if you want to assign the alarm to a
certain level of your vCloud Director infrastructure.
You can select infrastructure objects that match the alarm type or choose
containers from the vCloud Director hierarchy. For example, you can assign an
alarm of the vCloud Director vApp type to a specific vApp, organization VDC,
organization or vCloud Director cell.
Data Protection View choose this option if you want to assign the alarm to a
certain level of the Veeam Backup & Replication infrastructure.
You can select backup infrastructure objects that match the alarm type or choose
containers from the backup infrastructure hierarchy. For example, you can assign
an alarm of the Repository type to a specific repository, Veeam backup servers or
Veeam Backup Enterprise Manager.
You can combine various types of alarm assignment options for the same alarm. The type of
options you can combine depends on the alarm type. For example, if an alarm has the Virtual
machine type, you can include in the assignment scope virtual infrastructure, vCloud Director
and Veeam ONE Business View objects.
7. Repeat step 1-5 for all virtual infrastructure objects or categorization groups to which the
alarms must be assigned.

Notes
There are following restrictions for alarm assignment:
Alarm can be assigned to infrastructure objects that correspond to the alarm type. For
example, alarm of the VM type can be assigned to VMs or to a container that includes VMs.
The same applies to Veeam ONE Business View groups: the alarm type must match the
Business View category type. You cannot assign an alarm of the Host type to a Veeam ONE
Business View group that is used to categorize VMs.

Excluding Single Objects from Alarm Assignment Scope
You can exclude a single infrastructure object from alarm assignment:
4. Select the necessary alarm in the list and do one of the following:
Right-click the alarm and choose Exclude from the shortcut menu.
In the Actions pane on the right, click Exclude.
If you select a container object and choose an alarm that was triggered for its child object,
Veeam ONE will provide two exclusion choices exclude the child object only or exclude the
whole container from the alarm assignment scope.
For example, you have selected a cluster in the inventory pane. In the list of alarms, you will
see alarms on the cluster and alarms on the hosts in the cluster. If you select an alarm that
was triggered for a host, you can exclude either the host (child object) or the whole cluster
(container).
5. Click Yes in the dialog box to confirm exclusion.
Note: When you exclude an object from an alarm, all unresolved Warning or Error notifications that were
triggered by this alarm for the object will change their status to Resolved.

Excluding Multiple Objects from Alarm Assignment Scope
You can exclude infrastructure objects from the alarm assignment scope:
3. Select the necessary alarm in the list and do one of the following:
Right-click the alarm and select Edit exclusions from the shortcut menu.
In the Actions pane on the right, click Edit exclusions.
4. In the Edit exclusions window, click Add and choose objects that you want to exclude from
the assignment scope:
Infrastructure tree choose this option if you want to select objects from the
virtual infrastructure hierarchy.
You can select objects that match the alarm type or choose parent objects
(containers) from the virtual infrastructure hierarchy. For example, if you work with
the alarm of the Virtual Machine type, you can exclude a specific VM, host, cluster
and so on.
Business View choose this option if you want to exclude custom categorization
groups that you have previously configured in Veeam ONE Business View, or
objects from these groups.
For example, if you do not want to monitor resource usage metrics for VMs that
belong to the QA and RnD departments, you can group VMs by department in
Veeam ONE Business View and then exclude QA and RnD VMs from the alarm
assignment scope in Veeam ONE Monitor.
vCloud Director View choose this option if you want to select objects from the
vCloud Director hierarchy.
You can select objects that match the alarm type or choose containers from the
vCloud Director infrastructure hierarchy. For example, if you work with an alarm of
the vCloud Director vApp type, you can exclude a specific vApp, organization VDC,
organization or vCloud Director cell.
Data Protection View choose this option if you want to select objects from the
Veeam Backup & Replication hierarchy.
You can select backup infrastructure objects that match the alarm type or choose
containers from the backup infrastructure hierarchy. For example, if you work with
an alarm of the Repository type, you can exclude specific repositories, Veeam
backup servers or Veeam Backup Enterprise Manager.
You can combine various types of exclusion options for the same alarm. The type of
options you can combine depends on the alarm type. For example, if an alarm has
the Virtual machine type, you can exclude virtual infrastructure, vCloud Director and
Veeam ONE Business View objects from the alarm assignment scope.
5. Repeat step 3 for all virtual infrastructure objects or categorization groups you want to
exclude.
6. In the Edit exclusions window, click OK.

Other Ways to Exclude Multiple Objects from Alarm Assignment
You can also exclude objects from the alarm assignment scope on the Alarms tab of the Infrastructure
View, Business View, vCloud Director View or Data Protection View.
5. Repeat steps 2-5 of the procedure above.

Excluding Objects from Multiple Alarms
You can exclude a single infrastructure object from the scope of multiple alarms:
5. Select an alarm and do one of the following:
Right-click the alarm and choose Defined alarms in the shortcut menu.
In the Actions pane on the right, click Defined alarms.
Alternatively, you can right-click the object in the inventory pane and select Alarms >
Exclude from the shortcut menu.
6. In the Defined Alarms window, select check boxes next to alarms from which you want to
exclude the object.
7. Click OK.

Other Ways to Exclude Objects from Multiple Alarms
You can also exclude an object from multiple alarms using the object tree in the inventory pane.
3. In the inventory pane, right-click the necessary object in the inventory pane and select
Alarms > Exclude from the shortcut menu.
4. In the Defined Alarms window, select check boxes next to alarms from which you want to
exclude the object.
5. Click OK.

Viewing Alarm Exclusions
You can view the list of excluded objects for an alarm:
3. Select the necessary alarm in the list and click Show all exclusions in the Actions pane on
the right.

Copying Alarms
Instead of creating a new alarm from scratch, you can create a copy of an existing alarm and modify its
settings.
An alarm copy keeps the same settings as the original alarm, except the alarm assignment initially,
an alarm copy is not assigned to any virtual infrastructure, vCloud Director objects, Veeam ONE
Business View groups or Veeam Backup & Replication infrastructure components.
To copy an alarm:
3. Select the necessary alarm in the list.
Press and hold the [CTRL] or [SHIFT] key on the keyboard to select multiple alarms.
4. Do one of the following:
Right-click the selection and choose Copy from the shortcut menu.
In the Actions pane on the right, click Copy.
What You Can Do Next

After you create an alarm copy, you can change its settings and assignment scope:
1. Find the alarm copy in the list of alarm.
Veeam ONE uses the following pattern for names of alarm copies: 'Copy of <alarm name>'.
2. Change alarm settings and alarm assignment scope.

Disabling and Enabling Alarms
You can disable and enable predefined and custom alarms.
Disabling Alarms
You can disable alarms that you do not use for monitoring:
2. At the bottom of the information pane, click Alarm Management.
3. In the information pane, select the necessary alarm.
Right-click the selection and choose Disable from the shortcut menu.
In the Actions pane on the right, click Disable.
Note: After you disable an alarm, all unresolved Warning or Error notifications that were triggered by this
alarm will change their status to Resolved.
Enabling Alarms
To enable alarms that were previously disabled:
2. At the bottom of the information pane, click Alarm Management.
Right-click the selection and choose Enable from the shortcut menu.
In the Actions pane on the right, click Enable.

Deleting Alarms
You can delete alarms you no longer need for monitoring:
Right-click the selection and choose Delete from the shortcut menu.
In the Actions pane on the right, click Delete.
5. In the displayed dialog box, click Yes to confirm deletion.
Note: When you delete an alarm in the Alarm Management view, Veeam ONE retains its history all
triggered alarms and alarm status changes will be available on the Alarms view.
The status of a deleted alarm is changed to Resolved. To view history of a deleted alarm, you need to
apply the Show resolved alarms filter. For details on working with triggered alarms, see Viewing
Triggered Alarms.

Exporting and Importing Alarms
You can export alarms to an XML file and import alarms from an XML file. Exporting and importing
alarms can be useful if you need to back up you alarm settings, or if you want to copy alarm settings
from one Veeam ONE deployment to another.
You can use export and import possibilities to copy alarm settings between different Veeam ONE
versions. Veeam ONE 9.5 supports import of alarm settings that were exported from Veeam ONE 8.0
and 9.0.
Exporting Alarms
To export alarms to an XML file:
3. In the alarm management tree, select the type of infrastructure object for which you want to
export alarms.
4. Right-click the object and choose Export Alarms from the shortcut menu.
5. Save the XML file with alarm settings.
Importing Alarms
To import alarms from an XML file:
3. In the alarm management tree, right-click any object and choose Import Alarms from the
shortcut menu.
4. In the Alarms Import window:
Specify a path to an XML file with alarm settings.
Select the Import assignment check box if you want to import a list of alarms
together with their assignment settings.
Select the Replace all existing alarms check box if you want to replace existing
alarms with imported alarms.
If you do not select this check box but during import Veeam ONE detects an alarm
with a matching name, Veeam ONE will suggest you to update settings of the
existing alarm with data from the XML file. You can either replace the existing alarm
with the alarm from the XML file, or leave the existing alarm without any changes.
If an alarm in the XML file does not match any existing alarm by name, Veeam ONE
will create a new alarm.

5. When the import is finished, the Alarm Import window will display a report with the import
status, the total number of added, replaced and skipped alarms and the number of alarms
that were imported with errors.
Review the report and click Close to close the Import Alarms window.

Suppressing Alarms
During resource-consuming operations, such as backup, Veeam ONE may send a great number of
alarms informing about potential problems or increased resource pressure. If you do not want to
receive notifications during specific activities or at a specific period of time, you can disable alarms for
object in your infrastructure. When alarms are suppressed, Veeam ONE disregards events and state
changes to which the alarms react and does not trigger any alarms.
To suppress alarms, you can use one of the following options:
Maintenance mode
Alarm-specific suppression settings
Suppression of guest disk space alarms

Maintenance Mode
Maintenance mode is used to suppress alarms for specific infrastructure objects during planned
maintenance operations. When you place an infrastructure object to the maintenance mode, Veeam
ONE will suppress all alarms on this object.
You can enable the maintenance mode for single infrastructure objects or containers. When you
enable the maintenance mode for a container, you can choose to suppress alarms on its child objects
as well. For example, if you want to perform maintenance on a host, you can enable the maintenance
mode for the host itself and for all VMs on this host.
You can enable the maintenance mode manually or set a maintenance schedule.
Manual Maintenance Mode

You can enable the maintenance mode for an infrastructure object manually. After you place an
infrastructure object to the maintenance mode manually, Veeam ONE will stop triggering alarms for
this object until you manually disable the maintenance mode.
To enable the maintenance mode for an infrastructure object manually:
View, vCloud Director or Data Protection View.
3. In the inventory pane, right-click an infrastructure object and choose Maintenance Mode
from the shortcut menu.
4. Choose the scope of objects for which you want to enable the maintenance mode:
If you choose For this object, the maintenance mode will be enabled for the
selected object only. Alarms on its child objects will not be suppressed.
If you choose For this and all contained objects, the maintenance mode will be
enabled for the container and its child objects.
After you enable the maintenance mode for an infrastructure object, Veeam ONE will change the
infrastructure object icon, and will display the (Maintenance mode) label next to the object name in
the inventory pane.

Scheduled Maintenance Mode
You can configure a maintenance schedule for infrastructure objects. When a schedule is set, the
maintenance mode will be enabled and disabled automatically according to the schedule.
To configure a maintenance schedule:
3. In the inventory pane, right-click an infrastructure object and choose Schedule Maintenance
Mode from the shortcut menu.
4. In the Schedule Maintenance Mode window, configure the maintenance schedule.
a. Click Add.
b. In the Type field, specify how often the object must be placed into the
maintenance mode (once, monthly, weekly, daily).
c. In the Day/Date field, specify a day when the maintenance mode must be enabled.
d. In the Start time and End time fields, specify the start and end time of the
maintenance period.
e. Select the Apply to child objects check box if you want to enable the maintenance
mode on the object itself and its child objects.
f. In the Comment field, type additional information about the planned
maintenance. You can enter up to 512 characters in this field.
g. Select the Enabled check box to enable the new maintenance schedule.
h. Repeat steps a-g for each new schedule entry you want to add.
5. Click OK.

To temporary disable a maintenance schedule:
1. In the Schedule Maintenance window, clear the Enabled check box next to the necessary
schedule entry.
2. Click OK.
The disabled schedule will remain in the list, but it will not be applied to the object.
To delete a schedule:
1. In the Schedule Maintenance window, select the check box next to the schedule entry you
want to remove.
2. Click Delete.
3. Click OK.
Exiting Maintenance Mode

To exit a scheduled or manual maintenance mode
2. Right-click an object in the inventory pane and choose Exit Maintenance Mode.
After you exit the maintenance mode, Veeam ONE will resume triggering alarms.

Alarm-Specific Suppression Settings
For each alarm, you can configure individual suppression settings to 'switch off' the alarm during
specific resource-consuming operations (such as backup). For details on configuring alarm
suppression settings, see Creating Alarms > Step 6. Configure Alarm Suppression Settings.

Suppressing Guest Disk Space Alarms
You can suppress Guest disk space alarms for separate VM guest OS disks:
View or vCloud Director View.
3. In the inventory pane, choose the necessary VM.
4. In the information pane, open the Summary tab.
5. In the Guest Disk Usage section, click View all disks.
6. In the Guest disks list, select check boxes next to guest OS disks for which alarms must be
suppressed.
7. Click OK.

Modelling Alarm Number
Alarm modelling allows you to forecast the number and type of alarms that will be sent for a specific
infrastructure object within a chosen time interval. To model the alarm number, Veeam ONE applies
the current alarm settings to historical data collected for the chosen infrastructure object, and
calculates the approximate number of alarms that will be sent within the specified time interval in
future.
Alarm modelling can help you avoid receiving non-significant alarms, or vice versa missing important
events. After you change alarm settings, you can perform alarm modelling to estimate how many
alarms will be triggered for an infrastructure object if you keep the effective alarm settings. Taking into
consideration the modeled number of alarms, you can consider changing alarm settings for
example, if the number is too high, you may need to adjust alarm rule conditions.
To forecast the number of alarms that will be sent for a specific infrastructure object:
2. On the toolbar, click Modelling.
3. In the Alarm Modelling window, click Select and choose the necessary type of infrastructure
objects Infrastructure View, vCloud Director, Business View or Data Protection View.
4. In the Select Node window, choose an infrastructure object for which you want to model the
number of alarms.
5. In the Use data for the past list, specify the period for which historical data must be analyzed
(week, month or year).
6. In the list of alarms, select check boxes next to alarms for which you want to perform
modelling.
7. Click Start Modelling.
Veeam ONE will display the number of alarms of different severity that, according to the forecast, will
be sent within the selected period of time.

Other Ways to Perform Alarm Modelling
To perform alarm modelling for an infrastructure object:
2. At the bottom of the inventory pane, click the necessary view Infrastructure View, vCloud
Director, Business View or Data Protection View.
In the inventory pane, select an infrastructure object and click Modelling on the
toolbar.
In the inventory pane, right-click an infrastructure object and select Alarms >
Modelling from the shortcut menu.
To perform alarm modelling for selected alarms:
3. Select the one or more alarms in the list, right-click the selection and choose Modelling from
the shortcut menu.

Configuring Alarm Notifications
To ensure you do not miss critical events or state changes in the managed infrastructure, you can
configure Veeam ONE to send notifications when alarms are triggered. Veeam ONE supports two
types of alarm notifications:
Email Notifications
SNMP Traps

Email Notifications
To stay informed about potential problems, state changes, events and tasks performed by users in
your infrastructure, you can configure Veeam ONE to send email notifications about alarms. Email
notifications contain basic information necessary to find the root cause of an issue and resolve it.
An email notification can be sent when a new alarm is triggered or when an existing alarm changes its
status.
To configure alarm email notifications, perform the following steps:
1. Configure SMTP server settings.
2. Configure notification frequency.
3. Customize the email template.
4. Configure email recipients.
5. [Optional] Disable notifications about resolved alarms.

Step 1. Configure SMTP Server Settings
To deliver email notifications, Veeam ONE needs an SMTP server.
To configure SMTP settings:
2. On the toolbar, click Options and select Server Settings.
Alternatively, press [CTRL + S] on the keyboard.
3. In the SMTP Server field, specify DNS name or IP address of the SMTP server that must be
used for sending email notifications.
4. In the Port field, change the SMTP communication port if required.
The default port number is 25.
5. In the From field, enter an email address of the notification sender.
This email address will be displayed in the From field of the email header.
6. For a SMTP server with SSL support, select Enable SSL security to enable SSL data
encryption.
7. If your SMTP server requires authentication, select the Use authentication check box and
specify authentication credentials in the Login and Password fields.

Sending Test Email
To check whether you have specified SMTP settings correctly, you can send out a test email:
1. Click Send test email.
2. In the Test email settings window, specify an email address to which a test notification must
be sent.
3. Click OK.
The test email will be sent to the specified email address. Veeam ONE will notify you whether the
message was successfully sent.

Step 2. Configure Notification Frequency
Veeam ONE sends an email notification when a new alarm is created or when the status of an existing
alarm is changed. If you do not want to receive an email message each time a new alarm is triggered
or alarm status changes, you can change the notification frequency.
The frequency with which Veeam ONE sends email notifications is defined by notification policy. There
are two types of notification policies:
Mission Critical
Other
Enabling Mission Critical Notifications

Mission Critical notification policy is the default policy that is enabled for all infrastructure objects. This
policy prescribes Veeam ONE to send an email notification every time a new alarm is created or the
status of an existing alarm changes. An email notification contains details on the triggered alarm and
affected object.
The following image shows an example of an email notification for the Mission Critical policy.

To apply the Mission Critical notification policy to an infrastructure object:
1. Open Veeam ONE Monitor
3. In the Server Settings window, open the Notification Policy tab.
4. In the Email notification policies section, select Mission Critical and click Edit.
5. In the Edit Email Policy window, click Select and choose one of the following options:
Infrastructure Tree browse the virtual infrastructure hierarchy and select check
boxes next to objects or infrastructure segments to which the policy settings must
apply.
Business View browse the Veeam ONE Business View hierarchy and select
check boxes next to groups or infrastructure objects to which the policy settings
must apply.
Data Protection View browse the Veeam Backup & Replication infrastructure
and select check boxes next to infrastructure components to which the policy
settings must apply.
vCloud Director View browse the vCloud Director infrastructure and select
check boxes next to infrastructure components to which the policy settings must
apply.
6. In the Select Objects window, click Select.
7. In the Edit Email Policy window, Click OK.

Enabling Summary Notifications
Other notification policy prescribes Veeam ONE to accumulate information about alarms and send an
email notification once within a specific time interval (by default, a notification is sent once every 30
minutes). You do not receive a notification on every triggered alarm. Instead, Veeam ONE generates a
message with a list of all alarms triggered over the past period.
You can choose how often you want to receive summary email notifications. For example, if you
specify the time interval of 15 minutes, you will receive notifications with the list of alarms triggered
over the past 15 minutes. If no alarms are triggered over the past 15 minutes, you will not receive a
summary email notification.
The following image shows an example of a summary email notification for the Other policy.

By default, all infrastructure objects have the Mission Critical policy assigned. Before you apply the
Other notification policy to an object, you must remove the default Mission Critical policy assignment:
4. In the Email notification policies section, select the Mission Critical policy and click Edit.
5. In the Edit Email Policy window, select the necessary type of infrastructure objects Virtual
Infrastructure, vCloud Infrastructure or Backup Infrastructure) and click Remove.
6. In the Edit Email Policy window, click OK.
To apply the Other notification policy to one or more infrastructure objects:
4. In the Email notification policies section, select Other and click Edit.
5. In the Edit Email Policy window, click Select and choose one of the following options:
Infrastructure Tree browse the virtual infrastructure hierarchy and select check
boxes next to objects or infrastructure segments to which the policy settings must
apply.
Business View browse the Veeam ONE Business View hierarchy and select
check boxes next to groups or infrastructure objects to which the policy settings
must apply.
Data Protection View browse the Veeam Backup & Replication infrastructure
and select check boxes next to infrastructure components to which the policy
settings must apply.
vCloud Director View browse the vCloud Director infrastructure and select
check boxes next to infrastructure components to which the policy settings must
apply.
6. In the Select Objects window, click Select.
7. In the Time interval to send summary email (minutes) field, specify how often Veeam ONE
must send out a summary email informing about triggered alarms. The default time interval is
30 minutes.

8. In the Edit Email Policy window, click OK.

Step 3. Customize Email Template
You can customize the email template used for alarm notifications. In the template, you can change
the following items:
Email subject and body
Email format
Note: You can customize the email template for Mission Critical notifications only. You cannot modify the
template for alarm summary notifications sent in accordance with the Other notification policy. For
more information on notification policies, see Step 2. Configure Notification Frequency.
Configuring Email Subject and Body

You can customize the email notification subject:
4. In the Email notification policies section, select Mission Critical and click Edit template.
5. In the Email subject template field, specify the subject of the notification.
You can use the following variables in the subject text:
%ALARM_NAME% name of the alarm
%TIME% date and time when the alarm was triggered or when the alarm status
changed
%STATUS% current alarm status
%OLD_STATUS% status of the alarm before its status was changed
%OBJECT% affected infrastructure object
%OBJECT_TYPE% type of the affected infrastructure object
6. In the Select additional fields to include to the email notifications section, select check
boxes next to options you want to include in the body of the email message.
General options apply to email notification for all types of alarms.
KB article select this check box if an email notification must include a
knowledge base article.
Business View group select this check box if an email notification must include
a category assigned to the object in Veeam ONE Business View.
VM options apply to email notifications for VM alarms.
Guest OS IP address select this check box if an email notification must include
IP and MAC addresses of the affected VM.
Guest OS type select this check box if an email notification must include
information about the guest OS of the affected VM.
Guest OS hostname select this check box if an email notification must include a
DNS name of the affected VM.
Notes select this check box if an email notification must include custom notes
that can be specified in alarm details.

7. Click OK.

Configuring Email Format
By default, Veeam ONE sends email notifications in the HTML format. You can change notification
format to plain text. Note that plain text notifications do not support HTML elements, formatted text,
colors or graphics. Plain text notifications also do not include knowledge base articles.
To choose the email notification format:
3. On the SMTP Settings tab, in the Email format section, choose a format: HTML or Plain Text.
4. Click OK.

Step 4. Configure Email Recipients
To report about triggered alarms by email, Veeam ONE must know where to deliver messages. When
you configure alarm notifications, you must specify email addresses of users who will receive these
notifications.
There are several options for configuring email notification recipients:
You can add recipients to the default email notification group.
This option can be useful if you want to notify responsible personnel when critical alarms are
triggered or when alarms change their statuses.
You can configure recipients for individual alarms.
This option can be useful if you want to notify responsible personnel when a specific event
occurs in the managed infrastructure.
Configuring Default Email Notification Group

The default email notification group includes a list of recipients who must be notified about alarms by
email. All predefined alarms are configured to send email notifications to the default notification
group. You can also configure custom alarms to send notifications to the default notification group.
To add recipients to the default email notification group:
3. Open the Notification Policy tab.
4. In the Default email notifications group section, click Configure.
5. In the Default Email Notification Group window, specify email addresses of notification
recipients.
To add a recipient, in the Add this recipient field enter recipients email address and click
Add.
6. From the Notification Level list, choose the severity of alarms about which recipients must
be notified:
Any state an email notification will be sent every time when an alarm status
changes to Error, Warning or Info.
Errors and warnings an email notification will be sent every time when an
alarm status changes to Error or Warning.
Errors only an email notification will be sent every time when an alarm
status changes to Error.
7. Click OK.

You can temporary disable email notifications for specific recipients in the default email notification
group. The recipients will remain in the list, but they will no longer receive email notifications on
triggered alarms.
1. In the Default Email Notification Group window, clear the check box next to recipients
email address.
2. Click OK.
To permanently remove a recipient from the default email notification group:
1. In the Default Email Notification Group window, select an email address you want to delete
and click Remove.
2. Click OK.

Configuring Recipients for Specific Alarms
You can add email notification recipients to each alarm individually and specify alarm severity about
which the recipients must be notified.
To add one or more recipient to a specific alarm:
3. Open the Alarm settings window for the necessary alarm:
Double click the alarm in the list.
Select the alarm in the list and click Edit in the Actions pane on the right.
4. In the Alarm settings window, open the Actions tab.
5. On the Actions tab, click Add.
6. From the Action list, select the Send alarm notification option.
7. In the Value field, specify an email address of the recipient.
If you want to specify several recipients, separate email addresses with ";" (semicolon), ","
(comma) or ", " (comma with space).
8. From the Condition list, choose the severity of alarms about which the recipient must be
notified:
Any state an email notification will be sent every time when an alarm status
changes to Error, Warning or Info.
Errors and warnings an email notification will be sent every time when an
alarm status changes to Error or Warning.
Errors only an email notification will be sent every time when an alarm status
changes to Error.
9. Click Save.

Step 5. Disable Notifications About Resolved and Acknowledged Alarms
By default, Veeam ONE sends an email notification when an alarm is triggered, when its status
changes to Error, Warning, when an alarm is resolved and acknowledged. If you do not want to receive
notifications on resolved and acknowledged alarms, you can disable them.
To disable email notifications on resolved and acknowledged alarms:
4. In the Miscellaneous section, clear the Send notification when alarm metrics are back to
normal check box.
5. Click OK.

SNMP Traps
If you use SNMP to monitor applications and devices in the managed infrastructure, you can configure
Veeam ONE to report about triggered alarms by means of SNMP traps. When SNMP trap notifications
are enabled, Veeam ONE acts as an agent. It generates trap messages when an alarm is triggered, and
sends them to SNMP receivers. SNMP receivers can then forward the traps to a management
application.
SNMP traps sent by Veeam ONE include the following information:
Date and time the alarm was triggered
Name of the affected node
Old alarm status
New alarm status
Alarm name
Alarm summary
Veeam ONE supports SNMP versions 1, 2 and 3.
To configure SNMP traps, perform the following steps:
1. Configure SNMP receivers and manager.
2. Configure SNMP settings in Veeam ONE.
3. Change alarm action settings to enable SNMP traps for the necessary alarms.

Step 1. Configure SNMP Receivers and Manager
To receive and process SNMP traps generated by Veeam ONE, you must install and configure:
1. SNMP receivers that will listen for traps.
2. SNMP management application that will obtain and process traps from receivers.
The configuration procedure depends on the SNMP processing solution you use to handle traps. For
example, to learn how to configure SNMP receivers in Windows Server, see SNMP Traps in Windows
Server. To learn how to configure SNMP receivers with Net-SNMP, see SNMPTRAPD.

Step 2. Configure SNMP Settings in Veeam ONE
To send SNMP traps, Veeam ONE must know trap destinations. You must specify a list of receivers to
which Veeam ONE must send traps, and ports that SNMP receivers will be listening.
To configure SNMP trap destination settings in Veeam ONE:
3. In the Server Settings window, open the SNMP tab.
4. Click Add and configure receiver settings:
a. Double-click the added entry in the list.
Alternatively, select the receiver entry and click Configure.
b. In the Receiver field, specify FQDN or IP address of the SNMP receiver.
c. In the Port field, specify the port number.
The default SNMP port is 162.
d. In the Community string field, specify the community identifier.
e. Click OK.
f. To add a new receiver to the list, click Add and repeat steps a-e.
You can send trap notifications up to 4 different destinations.
5. In the list of SNMP receivers, choose the version of the SNMP protocol.
6. Click OK.

Step 3. Enable SNMP Notification for Alarms
To receive SNMP traps when an alarm is triggered, you must set SNMP notification as a response
action for each alarm manually.
To configure SNMP traps for an alarm:
3. To open the Alarm settings window for the necessary alarm, do one of the following:
Double click the necessary alarm in the list.
Select the alarm in the list and click Edit in the Actions pane on the right.
4. In the Alarm settings window, open the Actions tab.
5. On the Actions tab, click Add.
6. From the new Action list, select Send SNMP trap.
7. In the Condition field, specify at which state Veeam ONE must send trap messages.
8. Click Save.

Examples: How to Create Alarms
This section provides a number of examples of how to create Veeam ONE alarms.
How to Create Alarm Notifying About Multiple Snapshot Problems

This example shows how to create an alarm that notifies about multiple snapshot problems. The
example is based on the following scenario:
Users in your organization often forget to delete snapshots they do not use. You want Veeam ONE
to notify the administrator by email about VMs with multiple snapshot problems, such as large and
outdated snapshots.
To detect problems with forgotten snapshots, you can create an alarm based on two already existing
alarms: Latest snapshot age and Latest snapshot size:
3. In the alarm management tree, select All Alarms > VMware > Virtual Machine.
4. In the Actions pane on the right, click the New link.
5. In the Alarm Settings window, open the General tab and specify the alarm name Multiple
snapshot problems.
6. Open the Rules tab and add two rules that are based on existing alarms:
Latest snapshot size
Latest snapshot age
7. Select check boxes for both rules and click Link on the right. In the Rule condition window,
choose AND and click OK.

According to these joint rules, the alarm will be used to track snapshots that are large and
outdated at the same time.
8. Open the Assignment tab and do the following:

a. In the Assignment for alarm section, click Add and select Infrastructure tree.
b. Select an infrastructure object to which the alarm must be assigned.
c. Click Assign.
9. Open the Actions pane and do the following:

a. Select the default action.
b. From the Actions list, select Send email notification.

c. In the Value filed, enter email address of the virtual infrastructure administrator
who must receive alarm notifications by email.
d. From the Conditions list, select Errors and warnings.
10. Click Save.
Expected Result
The Multiple snapshot problems alarm is based on existing alarms: Latest snapshot age and Latest
snapshot size. Default thresholds for these alarms are:
If the age of the latest snapshot is more than 48 hours, an Error alarm is triggered.
If the size of the latest snapshot is more than 10% of the VM size, a Warning alarm is triggered.
If the size of the latest snapshot is more than 20% of the VM size, an Error alarm is triggered.
According to these settings, Veeam ONE:
Will trigger a Multiple snapshot problem Warning alarm for VMs that have snapshots with the
age more than 48 hours and size more than 10% but less than 20%.
Will trigger a Multiple snapshot problem Error alarm for VMs that have snapshots with the age
more than 48 hours and size more than 20%.
The administrator will be notified about Warning and Error alarms by email.

How to Create Alarm Notifying About Increased Host Disk Latency
This example shows how to add a rule to an existing alarm to get notifications about Hyper-V host disk
latency caused by memory pages usage. The example is based on the following scenario:
VMs on a Hyper-V host are trying to consume more RAM than there are memory resources available
on a host. This makes operating system swap the content of memory to disk. This negatively affects
the performance and causes host disk latency. You want to get notifications when Veeam ONE
detects host disk latency caused by the increased hard page faults. This way you will find out that
VMs lack RAM.
To create a custom alarm:

3. In the information pane, search for the Host Memory Pages Usage alarm.
4. Right-click the Host Memory Pages Usage alarm and select Copy.
The new alarm Copy of Host Memory Pages Usage will appear in the list.
5. Double-click the Copy of Host Memory Pages Usage alarm.
6. On the General tab of the Alarm Settings window:
a. Change alarm name to 'Disk Latency Caused by Hard Page Faults'.
b. Select the Enable this alarm check box.
c. Click Save.
7. At the bottom of the inventory pane, click Infrastructure View.

8. In the inventory pane, click the necessary Hyper-V host.
9. In the information pane, open the Disk tab.
10. Below the chart, in the Chart views list, select Disk Latency.

11. In the Performance chart legend section, right-click a latency counter and select Add this
counter to the existing alarm.
12. In the Select Alarm window, search for the Disk Latency caused by Hard Page Faults alarm and
click Add.
13. In the Alarm Settings window, open the Rules tab.
14. For the new counter Disk/Host: Avg Disk sec/read, specify triggering thresholds:
Warning: 70 Milliseconds
Error: 90 Milliseconds
Time period: 10 minutes
15. Select the check boxes of the two rules and click Link.
16. In the Rule condition window, select the And rule and click OK.
17. Click Save.

Expected Result
Each time hard page faults cause disk latency of 70 milliseconds, Veeam ONE will trigger a
Warning alarm.
If disk latency caused by hard page faults reaches 90 milliseconds, Veeam ONE will trigger the
Error alarm.

WORKING WITH TRIGGERED ALARMS
You can perform a number of actions with triggered alarms that were triggered by Veeam ONE:
View triggered alarms
Resolve alarms
Acknowledge alarms
View alarm history
Export triggered alarms

Viewing Triggered Alarms
To view alarms triggered for a specific infrastructure object:
3. In the inventory pane, select the necessary object.
The list of alarms shows alarms triggered for the selected infrastructure object and alarms for child
objects.
For every alarm, the following details are available:

Status current status of the alarm (Warning, Error, Resolved, Info or Acknowledged). If an
alarm was triggered multiple times, its latest state will be displayed in the list.
Alarm time date and time when the alarm was triggered. If the alarm was triggered
multiple times, the latest date time when the alarm was triggered will be displayed in the list.
Source name of the infrastructure object that caused the alarm. To view all alarms related
to the infrastructure object, click the source link.
Type type of the infrastructure object that caused the alarm.
Name alarm name. Click the name link to open alarm details in the Alarm Management
section.
If a corresponding alarm has been already deleted and not available in the Alarm
Management section, the alarm name is shown as plain text.
Repeat count the number of times the alarm was triggered. Click the repeat count link to
view the alarm history.
For more details, see Viewing Alarm History.

The Alarm details section of the information pane displays knowledge base for the selected alarm
description of the problem, possible causes, instructions for resolution, links to external resources and
other details.
The Actions pane on the right displays links to actions that you can perform against triggered alarms,
as well as navigation links.
Finding Alarms
To quickly find the necessary alarms, you can use filters and controls at the top of the Alarms list.
You can limit the list of alarms by the following criteria:

To display or hide alarms with a specific severity, click the Status icons Show all alarms,
Show objects with errors, Show objects with warnings, Show resolved alarms, Show information
messages and Show acknowledged messages.
To display or hide alarms for a specific type of infrastructure objects, click the object type
icons Show alarms for all types of objects or Show [object type] alarm.
To display alarms that are related to the selected infrastructure object, use the This object
icon. Release the icon to display alarms for the selected infrastructure object and alarms for its
child objects. Press the icon to display alarms for the selected object only.
To set the time interval within which alarms were triggered, use the Filter alarms by time
period icon and set the necessary time interval. Release the icon to discard the time interval
filter.
To find alarms by alarm name, use the search field.
You can click column names to sort alarms by a specific parameter. For example, to view repetitive
alarms, you can sort alarms in the list by Repeat Count in the descending order.

Resolving Alarms
Veeam ONE alarms can be resolved automatically or manually.
Alarms are resolved automatically in the following cases:
When an alarm is disabled or deleted.
When an object that caused the alarm is deleted or excluded from the alarm assignment
scope.
When conditions that caused the alarm are eliminated, and the alarm is configured to react to
this (the alarm resolve action is automatic).
For example, some alarms are configured to change the alarm severity to Resolved in specific
cases or events that occur in the managed infrastructure. Other alarms (such as alarms that
are triggered when resource usage is above a certain threshold) are resolved automatically
when the resource usage level is back to normal.
You can manually resolve alarms if the state of the monitored object has returned back to normal,
and/or if the alarm requires no further investigation and no corrective actions should be taken.

Resolving Individual Alarms
To resolve individual alarms:
5. In the list of alarms, select one or more alarms and do one of the following:
Right-click the selection and choose Resolve from the shortcut menu.
Select one or more alarms in the list and click Resolve in the Actions pane.
Press and hold the [CRTL] or [SHIFT] key to select several alarms.
6. In the Resolve Alarm window, specify a reason for changing the alarm status, or add any
other information.
The message you specify will be available in the Comment field of the alarm history details,
and in the email notification on resolved alarms. For more information, see Viewing Alarm
History and Notifications on Resolved Alarms.
7. Click OK.

Resolving Multiple Alarms
To resolve a number of alarms at once:
5. In the list of alarms, display all alarms that you want to resolve.
Use the filters and the search field at the top of the list to display the necessary alarms.
Right-click anywhere in the list of alarms and choose Resolve all alarms from the
shortcut menu.
In the Actions pane, click Resolve all alarms.
7. In the Resolve Alarm window, specify a reason for changing the alarm status, or add any
other information.
and in the email notification on resolved alarms. For more information, see Viewing Alarm
History and Notifications on Resolved Alarms.
8. Click OK.

Notifications on Resolved Alarms
When one or more alarms are resolved, Veeam ONE sends an email notification to users who monitor
the affected object. The notification includes information about the number of alarms resolved,
resolve action, time and reason, as well as the list of resolved alarms.
To receive a notification about resolved alarms, make sure that:
You have configured SMTP Server settings.
For details, see Step 1. Configure SMTP Server Settings.
Your email address is included either in the default notification group, or in the list of
notification recipients specified in the alarm action settings, and the notification level is set to
Any state.
For details, see Step 4. Configure Email Recipients.
Notifications about resolved and acknowledged alarms are enabled.
For details, see Step 5. Disable Notifications About Resolved and Acknowledged Alarms.
The following image shows an example of a notification about a resolved alarm.

Acknowledging Alarms
By acknowledging an alarm you can let other administrators know that an issue is being investigated
or resolved, so no attention is required from their side.
You can acknowledge alarms that have the Error or Warning status. When you acknowledge an alarm,
its status i9s changed to Acknowledged, and no response actions are performed on it. Additionally,
Veeam ONE notifies users who monitor the affected object that the alarm is acknowledged.

Acknowledging Individual Alarms
To acknowledge individual alarms:
5. In the list of alarms, select one or more alarms and do one of the following:
Right-click the selection and choose Acknowledge.
In the Actions pane on the right, click Acknowledge.
Press and hold the [CTRL] or [SHIFT] key to select multiple alarms.
6. In the Acknowledge Alarm window, specify a comment or a reason for acknowledging the
alarms.
and in the email notification on acknowledged alarms. For more information, see Viewing
Alarm History and Notifications on Acknowledged Alarms.
7. Click OK.

Acknowledging Multiple Alarms
To acknowledge a number of alarms at once:
5. In the list of alarms, display all alarms that you want to acknowledge.
Right-click anywhere in the list of alarms and choose Acknowledge all alarms
from the shortcut menu.
In the Actions pane, click Acknowledge all alarms.
7. In the Acknowledge Alarm window, specify a reason for changing the alarm status, or add
any other information.
and in the email notification on acknowledged alarms. For more information, see Viewing
Alarm History and Notifications on Acknowledged Alarms.
8. Click OK.

Notifications on Acknowledged Alarms
After an alarm is acknowledged, Veeam ONE sends a notification to users who monitor the affected
object. The notification includes information about the number of alarms acknowledged, time when
the alarms were acknowledged and reason, as well as the list of acknowledged alarms.
To receive a notification about acknowledged alarms, make sure that:
You have configured SMTP Server settings.
For details, see Step 1. Configure SMTP Server Settings.
Your email address is included either in the default notification group, or in the list of
notification recipients specified in the alarm action settings, and the notification level is set to
Any state.
For details, see Step 4. Configure Email Recipients.
Notifications about resolved and acknowledged alarms are enabled.
For details, see Step 5. Disable Notifications About Resolved and Acknowledged Alarms.
The following image shows an example of a notification about an acknowledged alarm.

Viewing Alarm History
Veeam ONE keeps the history of alarm status changes for every triggered alarm. The number of times
the alarm changed its status is displayed as the Repeat Count value.
To view alarm history:
4. Select the necessary alarm and do one of the following:
Click the Repeat Count link in the list of alarms.
Double-click the alarm in the list.
Right-click the alarm and select Show history from the shortcut menu.
In the Actions pane, click Show history.
The Alarm history window provides detailed data on the history of alarm status changes: assigned
status, time, rule that triggered the alarm or changed its state, and comments for resolved or
acknowledged alarms.

Exporting Triggered Alarms
You can export to a CSV file information about triggered alarms. For each exported alarm, the
following details are available:
Alarm status
Alarm name
Date and time when the alarm was triggered
Name of the affected object
Repeat count
To export one or more triggered alarms to a CSV file:
5. In the list of alarms, display all alarms that you want to export.
6. At the top of the alarms list, click Export.
7. Save the CSV file with exported data.
8. Click OK.
The following image shows an example of alarm details exported to a CSV file.

WORKING WITH INTERNAL ALARMS
In addition to alarms for monitoring the virtual and backup infrastructure, Veeam ONE includes a set
of predefined alarms to monitor internal Veeam ONE problems such as data collection, connection
problems or license issues. For the list and description of internal alarms, see Internal Alarms and
Events.

Viewing Internal Alarms
To view Veeam ONE internal alarms:
2. In the Configuration issues pane, click the Show details link.
3. Click the object name to drill-down to the list of alarms for the selected object.

Configuring Internal Alarms
You can configure internal alarms similarly to regular alarms:
3. In the alarm management three, select the Internal node.
4. Select an alarm in the list and do one of the following:
Double click the alarm.
In the Actions pane, click Edit.

APPENDIX A. ALARMS
This section lists predefined Veeam ONE alarms.
Veeam Backup & Replication Alarms

This section describes predefined alarms for Veeam Backup & Replication infrastructure components:
Enterprise Manager
Backup Server
Repository
Proxy
WAN Accelerator
Tape Server
Cloud Repository
Cloud Gateway
Enterprise Manager
Resolve
Alarm Name Event/Condition Severity Description
Action
Veeam
Veeam ONE failed
Backup
to connect to
Enterprise
State not equals Connected. Error Automatic Veeam Backup
Manager
Enterprise
connection
Manager.
failure
Veeam Backup & Replication Server
Resolve
Action
One or more
backup copy jobs
exceeded defined
Backup copy
Based on event window, and data
job exceeded
VeeamBpCopyJobNetworkWindowExceede Error Manual transfer between
data transfer
dEvent source and target
window
backup
repositories has
been stopped.
Based on event One or more VMs
Error
VeeamBpBackupSyncSessionErrorEvent could not be
Backup copy
Manual successfully
job state Based on event
Warning copied from the
VeeamBpBackupSyncSessionWarningEvent backup repository.
Job is in a disabled
Backup job state for more that
Job is disabled for more than 12 hours Warning Automatic
disable allowed time
period.

Resolve
Action
Based on event
Error One or more VMs
Backup job VeeamBpBackupSessionErrorEvent
Manual failed to backup
state Based on event
Warning successfully.
VeeamBpBackupSessionWarningEvent
Based on event
Error
VeeamBpFileTapeSessionErrorEvent
Backup to Error
VeeamBpVmTapeSessionErrorEvent failed to be
tape job Manual
Based on event transferred to the
status Warning
VeeamBpFileTapeSessionWarningEvent tape device.
Based on event
Warning
VeeamBpVmTapeSessionWarningEvent
Based on event One or more files
Warning
File copy job VeeamBpCopySessionWarningEvent failed to be
Manual
state Based on event transferred to the
Error destination folder.
VeeamBpCopySessionErrorEvent
One or more jobs
Job exceeded exceeded allowed
Based on event
backup Error Manual backup window
VeeamBpJobWindowExceededEvent
window and has been
terminated.
Based on event
Warning
VeeamBackupServerLicenseExpiration
License Based on event Veeam Backup &
Resolve
expiration VeeamBackupServerLicenseChanged Automatic Replication license
date Based on event expired.
VeeamBackupServerLicenseExpirationResol Resolve
ve
Job duration is more than 480 minutes Error Job has exceeded
Max allowed
Manual its allowed
job duration Job duration is more than 120 minutes Warning execution time.
Based on event
Quick Warning One or more VMs
VeeamBpQMigrationSessionWarningEvent
Migration job Manual failed to migrate
Based on event to another host.
state Error
VeeamBpQMigrationSessionErrorEvent
Based on event
Error One or more VMs
Replication VeeamBpRepSessionErrorEvent
Manual failed to replicate
job state Based on event
VeeamBpRepSessionWarningEvent
Based on event
VeeamBackupServerLicenseSupportExpirati Warning
on Veeam Backup &
Support
Based on event Replication
expiration Resolve Automatic
VeeamBackupServerLicenseChanged prepaid support
date
Based on event contract expired.
VeeamBackupServerLicenseSupportExpirati Resolve
onResolved
Error
SureBackup VeeamBpSbSessionErrorEvent could not be
Manual
job state Based on event successfully
Warning verified.
VeeamBpSbSessionWarningEvent

Resolve
Action
Veeam
Backup & Connection to
Replication Veeam Backup &
State not equals Connected Error Automatic
Server Replication server
connection failed.
failure
Based on event Veeam Broker
VeeamBackupServerBrokerServiceDownEve Warning Service that
nt interacts with
Veeam Based on event virtual
Broker VeeamBackupServerBrokerServiceDownEve Resolve Automatic infrastructure to
Service state nt collect and cache
Based on event its topology is not
VeeamBackupServerBrokerServiceDownEve Resolve started and not
nt working properly.
Repository
Resolve
Action
State equals Not accessible for more than 5 Veeam Backup &
Backup Error
minutes Replication server
repository
Automatic lost connection to
connection State equals Warning for more than 5
Warning the backup
failure minutes repository.
Backup Free space is below 5% Error Backup repository
repository Automatic is low on free
Free space is below 10% Warning space.
free space
Veeam backup
Backup repository version
repository does not match
Component version mismatch Warning Automatic
version is out- the version of
of-date Veeam Backup &
Replication server.
Proxy
Resolve
Action
Veeam Backup &

Backup proxy
State not equals Accessible for more than 5 Replication server
connection Error Automatic
minutes lost connection to
failure
the proxy server.
Veeam backup
proxy version
Backup proxy
does not match
version is out- Component version mismatch Warning Automatic
the version of
of-date
Veeam Backup &
Replication server.

WAN Accelerator
Resolve
Action
Veeam Backup &

WAN
Replication server
accelerator State not equals Accessible for more than 5
Error Automatic lost connection to
connection minutes
the WAN
state
accelerator
Veeam WAN
accelerator
WAN
version does not
accelerator
Component version mismatch Warning Automatic match the version
version is out-
of Veeam Backup
of-date
& Replication
server.
Tape Server
Resolve
Action
Veeam Backup &

Tape server
State not equals Accessible for more than 5 Replication server
connection Error Automatic
minutes lost connection to
state
the tape server.
Veeam tape server
version does not
Tape server
match the version
version is out- Component version mismatch Warning Automatic
of Veeam Backup
of-date
& Replication
server.
Cloud Repository
Resolve
Action
Free space is below 10% Warning Cloud repository

Cloud
is low on
repository Automatic
Free space is below 5% Error available free
free space
space.
Cloud 14 days to lease expiration Warning
repository Cloud repository
lease Automatic lease time is
0 days to lease expiration Error about to expire.
expiration
date
Number of VMs
stored in the
VM backups
Number of stored VMs is above the specified cloud repository
in cloud Warning Automatic
threshold is above the
repository
defined
threshold.

Cloud Gateway
Resolve
Action
Veeam Backup &

Cloud
Replication server
gateway State not equals Accessible for more than 5
Error Automatic lost connection to
connection minutes
the cloud
state
gateway.
Veeam cloud
Cloud gateway version
gateway does not match
Component version mismatch Warning Automatic
version is the version of
out-of-date Veeam Backup &
Replication server.

This section describes rules and events that can be used to create alarms for virtual and backup
infrastructures.
Internal Alarms and Events

The following table describes internal Veeam ONE Monitor alarms and associated alarm events.
Alarm Name Rule Event Severity Description
Backup VeeamBpPerfCollectionFailedEvent Error

Veeam ONE failed to
performance
VeeamMonitorServicesStartedEvent Resolve collect performance data
data
from the specified backup
collection
VeeamBpPerfCollectionFailedResolvedEvent Resolve server.
failure
Backup server VeeamNoHostConnectionEvent Error Veeam ONE failed to

data collect data from a Veeam
VeeamNoHostConnectionResolvedEvent Resolve
collection Backup & Replication
problem VeeamMonitorServicesStartedEvent Resolve server.
VeeamDPCacheEvent Warning
Veeam ONE failed to write
Disk cache
VeeamDPCacheResolvedEvent Resolve performance data to the
error
disk cache folder.
VeeamMonitorServicesStartedEvent Resolve
VeeamEventCollectionFailedEvent Error
Events data Veeam ONE failed to
collection VeeamEventCollectionFailedResolvedEvent Resolve collect events data from
failure the objects specified.
Hardware VeeamHardwareSensorsCollectionEvent Error

Veeam ONE failed to
sensors
VeeamHardwareSensorsCollectionResolvedEvent Resolve collect host hardware
collection
information.
failure VeeamMonitorServicesStartedEvent Resolve
Performance VeeamPerfCollectionFailedEvent Error

Veeam ONE failed to
data
VeeamPerfCollectionFailedResolvedEvent Resolve collect performance data
collection
from the objects specified.
VeeamSqlLowDbFreeSpaceEvent Warning Veeam ONE database size

SQL Server is close to maximum
Express VeeamSqlLowDbFreeSpaceResolvedEvent Resolve database size supported
database size by SQL Server Express
VeeamMonitorServicesStartedEvent Resolve Edition.
VeeamInfCollectionFailedEvent Error
Topology Veeam ONE failed to
collection VeeamInfCollectionFailedResolvedEvent Resolve collect infrastructure
failure topology.
vCloud VeeamVcdBlockingTaskUpdateFailedEvent Error

Veeam ONE failed to
Director
update vCloud Director
blocking tasks VeeamVcdBlockingTaskUpdateFailedResolvedEvent Resolve blocking tasks list.
update failure
vCloud VeeamNoVcdHostConnectionEvent Error Veeam ONE failed to

Director VeeamNoVcdHostConnectionResolvedEvent Resolve collect performance and
connection configuration data from
failure VeeamMonitorServicesStartedEvent Resolve vCloud Director.
vCloud VeeamVcdStrandedItemUpdateFailedEvent Error

Director Veeam ONE failed to
stranded update vCloud Director
items update VeeamVcdStrandedItemUpdateFailedResolvedEvent Resolve stranded items list.
failure
VeeamLicenseExpirationWarningEvent Warning
Veeam ONE VeeamLicenseExpirationErrorEvent Error

license Veeam ONE license is
VeeamLicenseChangedEvent Resolve
expiration going to expire soon.
date VeeamLicenseExpirationResolvedEvent Resolve
Veeam ONE VeeamSocketExceedEvent Error

The number of licensed
license
VeeamSocketExceedResolvedEvent Resolve servers has been
sockets
exceeded.
exceeded VeeamMonitorServicesStartedEvent Resolve
VeeamLicenseUpdateErrorEvent Warning License update failure can

take place for a number of
VeeamLicenseUpdateResolvedEvent Resolve reasons such as
connection failure, invalid
Veeam ONE identifier, expired
license contract, etc. In case of a
update failure connection problem and
VeeamMonitorServicesStartedEvent Resolve licensing server key
generation error, Veeam
ONE will retry to update
the license key.
VeeamVMsExceedErrorEvent Error Your license limit has

been exceeded. You need
Veeam ONE VeeamVMsExceedWarningEvent Warning to purchase additional
license VMs VMs licensing before all
exceeded VeeamVMsExceedResolvedEvent Resolve VMs exceeding the
licensed amount will no
VeeamMonitorServicesStartedEvent Resolve longer be monitored.
Veeam ONE N/A Error

Veeam ONE Reporter
Reporter
session task failed.
collection job N/A Warning
VeeamLicenseSupportExpirationWarningEvent Warning
Veeam ONE VeeamLicenseSupportExpirationErrorEvent Error

Veeam ONE support
support
VeeamLicenseChangedEvent Resolve period is going to expire
expiration
soon.
date VeeamLicenseSupportExpirationResolvedEvent Resolve
VeeamNoHostConnectionEvent Error
Virtual Server Connection to virtual
connection server has failed.
VeeamNoHostConnectionResolvedEvent Resolve


Veeam Backup & Replication Alarms and Events
This section describes predefined alarms and associated events for Veeam Backup & Replication
infrastructure components:
Enterprise Manager
Backup Server
Repository
Proxy
WAN Accelerator
Tape Server
Cloud Repository
Cloud Gateway
Enterprise Manager
Resolve
Action
Veeam Backup Veeam ONE failed to

Enterprise connect to Veeam
N/A Error Automatic
Manager Backup Enterprise
connection failure Manager.
Veeam Backup & Replication Server

Resolve
Action
One or more backup

copy jobs exceeded
Backup copy job defined window, and
VeeamBpCopyJobNetworkWind
exceeded data Error Manual data transfer between
owExceededEvent
transfer window source and target
backup repositories has
been stopped.
VeeamBpBackupSyncSessionErr
Error One or more VMs could
orEvent
Backup copy job not be successfully
Manual
state VeeamBpBackupSyncSessionWa
copied from the backup
Warning repository.
rningEvent
Job is in a disabled
Backup job
N/A Warning Automatic state for more that
disable
allowed time period.
VeeamBpBackupSessionErrorEve
Error
nt
One or more VMs failed
Backup job state Manual
to backup successfully.
VeeamBpBackupSessionWarnin
Warning
gEvent

Resolve
Action
VeeamBpFileTapeSessionErrorEv
Error
ent
VeeamBpVmTapeSessionErrorEv
Error
ent One or more VMs failed
Backup to tape
Manual to be transferred to the
job status VeeamBpFileTapeSessionWarnin tape device.
Warning
gEvent
VeeamBpVmTapeSessionWarnin
Warning
gEvent
VeeamBpCopySessionWarningE
Warning One or more files failed
vent
File copy job state Manual to be transferred to the
destination folder.
VeeamBpCopySessionErrorEvent Error
One or more jobs

Job exceeded VeeamBpJobWindowExceededE exceeded allowed
Error Manual
backup window vent backup window and
has been terminated.
VeeamBackupServerLicenseExpi
Warning
ration
Veeam Backup &
License expiration VeeamBackupServerLicenseCha
Resolve Automatic Replication license
date nged
expired.
VeeamBackupServerLicenseExpi
Resolve
rationResolve
Error
Max allowed job Job has exceeded its
N/A Manual
duration Warning
allowed execution time.
VeeamBpQMigrationSessionWar
Warning
ningEvent One or more VMs failed
Quick Migration
Manual to migrate to another
job state VeeamBpQMigrationSessionErro host.
Error
rEvent
VeeamBpRepSessionErrorEvent Error
One or more VMs failed
Replication job
Manual to replicate
state VeeamBpRepSessionWarningEv
ent
VeeamBackupServerLicenseSup
Warning
portExpiration
Veeam Backup &
Support VeeamBackupServerLicenseCha Replication prepaid
Resolve Automatic
expiration date nged support contract
expired.
VeeamBackupServerLicenseSup
Resolve
portExpirationResolved
VeeamBpSbSessionErrorEvent Error
One or more VMs could
SureBackup job
Manual not be successfully
state VeeamBpSbSessionWarningEve
Warning verified.
nt
Veeam Backup & Connection to Veeam

Replication Server N/A Error Automatic Backup & Replication
connection failure server failed.

Resolve
Action
VeeamBackupServerBrokerServi Veeam Broker Service

Warning
ceDownEvent that interacts with
virtual infrastructure to
Veeam Broker VeeamBackupServerBrokerServi
Resolve Automatic collect and cache its
Service state ceDownEvent
topology is not started
VeeamBackupServerBrokerServi and not working
Resolve properly.
ceDownEvent
Repository
Resolve
Action
Error Veeam Backup &

Backup repository N/A Replication server lost
Automatic
connection failure Warning
connection to the
backup repository.
Error
Backup repository Backup repository is low
N/A Automatic
free space Warning
on free space.
Veeam backup
Backup repository repository version does
version is out-of- N/A Warning Automatic not match the version
date of Veeam Backup &
Replication server.
Proxy
Resolve
Action
Veeam Backup &

Backup proxy Replication server lost
N/A Error Automatic
connection failure connection to the
proxy server.
Veeam backup proxy

Backup proxy version does not match
version is out-of- N/A Warning Automatic the version of Veeam
date Backup & Replication
server.

WAN Accelerator
Resolve
Action
Veeam Backup &

WAN accelerator Replication server lost
N/A Error Automatic
connection state connection to the WAN
accelerator
Veeam WAN accelerator

WAN accelerator version does not match
version is out-of- N/A Warning Automatic the version of Veeam
date Backup & Replication
server.
Tape Server
Resolve
Action
Veeam Backup &

Tape server Replication server lost
N/A Error Automatic
connection state connection to the tape
server.
Veeam tape server

version does not match
Tape server version
N/A Warning Automatic the version of Veeam
is out-of-date
Backup & Replication
server.
Cloud Repository
Resolve
Action
Warning
Cloud repository Cloud repository is low
N/A Automatic
free space Error
on available free space.
Cloud repository Warning

Cloud repository lease
lease expiration N/A Automatic
time is about to expire.
date Error
Number of VMs stored

VM backups in in the cloud repository
N/A Warning Automatic
cloud repository is above the defined
threshold.

Cloud Gateway
Resolve
Action
Veeam Backup &

Cloud gateway Replication server lost
N/A Error Automatic
connection state connection to the
cloud gateway.
Veeam cloud gateway

Cloud gateway version does not
version is out-of- N/A Warning Automatic match the version of
date Veeam Backup &
Replication server.

VMware vSphere Alarms
This section describes predefined alarms for VMware vSphere infrastructure components:
vCenter Server
Cluster
Host
Virtual Machine
Datastore
Any VMware Object
vCloud Director vApp
vCloud Director Organization
vCloud Director Org VDC
vCloud Director Provider VDC
vCenter Server
Resolve
Action
This event records a

failed user logon. The
combination of
username, password,
Bad vCenter Server and permissions is the
Based on event
username logon Error Manual mechanism by which
BadUsernameSessionEvent
attempt vCenter Server
authenticate a user for
access and authorize
the user to perform
activities.
Insufficient user Based on event failed user logon due
Error Manual
access permissions NoAccessUserEvent to insufficient access
permission.
This event records if
Invalid license Based on event
Error Manual the license edition is
edition InvalidEditionEvent
set to an invalid value.
Based on event This event records the
License expired Error Manual
LicenseExpiredEvent expiration of a license.
the required licenses
License file Based on event
Error Manual could not be reserved
restricted LicenseRestrictedEvent
because of a restriction
in the option file.
This event records that
License is not Based on event
Error Manual the inventory is not
compliant LicenseNonComplianceEvent
license compliant.
Maximum host Based on event
Error Manual the inventory of hosts
connections reached HostInventoryFullEvent
has reached capacity.

Resolve
Action
These are events

reported by License
Manager. A
NoLicenseEvent is
No license Based on event
Error Manual reported if the required
reservation NoLicenseEvent
licenses could not be
reserved. Each feature
that is not fully
licensed is reported.
A potential
misconfiguration or I/O
performance issue
caused by a non-ESX
workload has been
detected. This alarm is
Based on event triggered when
Non VI workload
NonVIWorkloadDetectedOnDat Error Manual Storage I/O Control
detected
astoreEvent (SIOC) detects that a
workload that is not
managed by SIOC is
contributing to I/O
congestion on a
datastore that is
managed by SIOC.
This event records
vCenter Server
Based on event when the vCenter
agent uninstall Error Manual
VcAgentUninstallFailedEvent Server agent on a host
failure
failed to uninstall.
This event records
vCenter Server
Based on event when the vCenter
agent upgrade Error Manual
VcAgentUpgradeFailedEvent Server agent on a host
failure
failed to upgrade.
This event records an
vCenter Server Based on event
Error Manual expired vCenter Server
license expired ServerLicenseExpiredEvent
license.
Cluster
Resolve
Action
This event records

Based on event when admission
Admission control
DasAdmissionControlDisabledE Information Automatic control checks have
disabled
vent been disabled in a HA
cluster.
This event records
Based on event when admission
Admission control
DasAdmissionControlEnabledE Information Automatic control checks have
enabled
vent been enabled in a HA
cluster.
all hosts have been
All hosts in cluster Based on event
Error Manual isolated from the
isolated DasClusterIsolatedEvent
network in a HA
cluster.

Resolve
Action
This event records DRS

DRS invocation Based on event invocation failure. DRS
Error Manual
failure DrsInvocationFailedEvent invocation not
completed.
This event records
HA disabled for Based on event
Information Automatic when a cluster has
cluster DasDisabledEvent
been disabled for HA.
This event records
HA enabled for Based on event
Information Automatic when a cluster has
cluster DasEnabledEvent
been enabled for HA.
This event records
Host cluster when a cluster's host
Based on event
capacity Error Manual capacity cannot satisfy
ClusterOvercommittedEvent
overcommitted resource configuration
constraints.
Based on event
com.vmware.vc.HA.ClusterCont
ainsIncompatibleHosts
Based on event
com.vmware.vc.HA.DasFailover
HostIsolatedEvent
Based on event One of the hosts in an
vSphere cluster
com.vmware.vc.HA.DasFailover Warning Manual HA cluster has been
warning
HostPartitionedEvent isolated.
Based on event
com.vmware.vc.HA.DasFailover
HostUnreachableEvent
Based on event
com.vmware.vc.HA.DasHostIsol
atedEvent
Host
Resolve
Action

failed user logon. The
combination of
username, password,
Bad Host username Based on event and permissions is the
Warning Manual
logon attempt BadUsernameSessionEvent mechanism by which
hosts authenticate a
user for access and
authorize the user to
perform activities.
Based on event
esx.problem.storage.iscsi.disc
overy.connect.error
The iSCSI initiator is
Based on event
Connection to iSCSI unable to establish a
esx.problem.storage.iscsi.disc Error Manual
storage target failure connection to the
overy.login.error
target.
Based on event
esx.problem.storage.iscsi.targ
et.connect.error

Resolve
Action
Based on event
esx.problem.storage.iscsi.targ
et.login.error
Based on event This event records that
DrsExitStandbyModeFailedEv Error Distributed Power
ent Management tried to
Based on event bring a host out of
Resolve standby mode, but
DrsExitedStandbyMode
failed.
DPM failed to bring Standby Mode powers
host out of standby Automatic off a host and allows it
mode to be powered back on
Based on event again through the
Resolve Wake-on-LAN protocol.
ExitedStandbyMode
It can be triggered
either manually or
automatically by
vCenter Server.
the host has
successfully entered
standby mode initiated
by Distributed Power
Based on event
DRS host standby Management. A host in
DrsEnteredStandbyModeEve Information Automatic
mode entrance this mode has no
nt
running virtual
machines and no
provisioning
operations are
occurring.
Distributed Power
DRS host standby Based on event
Information Automatic Management brings
mode exit DrsExitedStandbyModeEvent
this host out from
standby mode.
This event records
when resource
Based on event
DRS synchronization configuration
DrsResourceConfigureFailedE Error Manual
failure specification
vent
synchronization fails
on a host.
The list of hosts that
have the DVS
DVS host
Based on event configuration on the
configuration out of Warning Manual
OutOfSyncDvsHost host diverged from
sync
that of the vCenter
Server.
Based on event Link Aggregation
esx.problem.net.lacp.uplink.fa Control Protocol
ESX(i) host network il.duplex (LACP) is included in
Error Manual
uplink failure Based on event IEEE specification as a
esx.problem.net.lacp.uplink.fa method to control the
il.speed bundling of several

Resolve
Action
physical ports together
to form a single logical
channel. LACP allows a
network device to
Based on event
negotiate an automatic
esx.problem.net.lacp.uplink.in
bundling of links by
active
sending LACP packets
to the peer (directly
connected device that
also implements LACP).
Based on event
esx.problem.cpu.amd.mce.dr
am.disabled
Based on event
esx.problem.cpu.intel.ioapic.li
sting.error
ESX(i) host has
ESX(i) host CPU Based on event
Error Manual experienced a CPU
hardware error esx.problem.cpu.mce.invalid
hardware error.
Based on event
esx.problem.cpu.smp.ht.invali
d
Based on event
esx.problem.cpu.smp.ht.num
pcpus.max
Based on event
ESX(i) host network DHCP client lease issue
esx.problem.dhclient.lease.no Error Manual
error has been detected.
ne
Based on event Link Aggregation
esx.problem.net.lacp.uplink.b Control Protocol
locked (LACP) is included in
IEEE specification as a
method to control the
bundling of several
physical ports together
ESX(i) host network to form a single logical
Warning Manual
uplink problems Based on event channel. LACP allows a
esx.problem.net.lacp.uplink.d network device to
isconnected negotiate an automatic
bundling of links by
sending LACP packets
to the peer (directly
connected device that
also implements LACP).
Based on event
esx.problem.dhclient.lease.off
ESX(i) host network ered.error DHCP client lease issue
Warning Manual
warning Based on event has been detected.
esx.problem.dhclient.lease.pe
rsistent.none
Storage device
Based on event
becomes permanently
ESX(i) host storage esx.problem.scsi.device.state.
Error Manual lost while SCSI
error permanentloss.withreservatio
reservation is held by
nheld
ESXi.
An operation on the
ESX(i) host storage Based on event
Error Manual root file system has
failure esx.problem.visorfs.failure
failed.

Resolve
Action
Based on event
esx.problem.visorfs.inodetabl Warning One of the host's
ESX(i) host storage e.full ramdisks reached the
Manual
warning Based on event limit for the number of
esx.problem.visorfs.ramdisk.f Warning files it can contain.
ull
Average memory usage is for
Warning
15 minutes is above 80%
Host available This host is low on
Automatic
memory available memory.
Average memory usage is for Error
Host state equals
Disconnected for 5 minutes This alarm monitors
and more. the VMware vCenter
Host connection
Warning Automatic Server API for events
failure Host state equals Not indicating that a host is
responding for 5 minutes and disconnected.
more.
Based on event This event indicates
vprob.net.connectivity.lost that one or more
Based on event Error portgroups in the host
esx.problem.net.connectivity. have lost connectivity
Host connectivity lost to the network,
Automatic
failure resulting in
Based on event unavailability of all
esx.clear.net.connectivity.rest Resolve physical connections
ored to the network from
this switch.
Average CPU Ready for 15
Warning This Host has exceeded
minutes is above 15%
Host CPU ready Automatic the threshold for CPU
Average CPU Ready for 15 Ready Percent.
Error
Average CPU usage for 15
Warning This host has exceeded
Host CPU usage Automatic the threshold for CPU
Average CPU usage for 15 usage.
Error
Average datastore bus resets
Warning This host disk (vmhba)
for 15 minutes is above 2
Host disk bus resets Automatic has logged one or
Average datastore bus resets more SCSI bus resets.
Error
for 15 minutes is above 4
Average datastore command
aborts for 15 minutes is Warning
above 2 This host disk (vmhba)
Host disk SCSI aborts Automatic has logged one or
Average datastore command more SCSI aborts.
aborts for 15 minutes is Error
above 4
Based on event This event records that
Error
ExitStandbyModeFailedEvent the host failed to exit
standby mode.
Standby Mode powers
off a host and allows it
Host failed to exit to be powered back on
Automatic
standby mode Based on event again through the
Resolve
ExitedStandbyMode Wake-on-LAN protocol.
It can be triggered
either manually or
automatically by
vCenter Server.

Resolve
Action
Usually, such triggers

indicate that a host has
actually failed, but
failure reports can
sometimes be
incorrect. A failed host
Based on event
reduces the available
Host HA agent failure com.vmware.vc.HA.HostAgen Error Manual
capacity in the cluster
tErrorEvent
and, in the case of an
incorrect report,
prevents vSphere HA
from protecting the
virtual machines
running on the host.
This event records
Based on event
Host HA disabled Information Automatic when HA has been
HostDasDisabledEvent
disabled on a host.
This event records
when the HA (high-
Based on event
Host HA enabled Information Automatic availability) agent has
HostDasEnabledEvent
been enabled on a
host.
Hardware sensor equals
Warning
Warning One of the hosts'
Host hardware status Hardware sensor equals Alert Error Automatic hardware sensors has
Hardware sensor equals changed its status.
Warning
Unknown
the IP address
Based on event
Host IP inconsistent Warning Manual resolution returned
HostIpInconsistentEvent
different addresses on
the host.
Based on event
Host IP to short name the host's IP address
HostIpToShortNameFailedEve Warning Manual
failed could not be resolved
nt
to a short name.
the isolation address
Based on event could not be pinged.
Host Isolation IP not
HostIsolationIpPingFailedEve Warning Manual The default isolation
available
nt address is the service
console's default
gateway.
Based on event This event records an
Host license expired Error Manual
HostLicenseExpiredEvent expired host license.
Average memory pressure for
Warning This host has exceeded
Host memory 15 minutes is above 150%
Automatic the threshold for
pressure Average memory pressure for
Error memory pressure.
Based on event
esx.problem.net.vmnic.linksta Error
Host NIC connection te.down Physical NIC linkstate is
Automatic
state Based on event down.
esx.clear.net.vmnic.linkstate.u Resolve
p

Resolve
Action

Based on event
Host not compliant Warning Manual host went out of
HostNonCompliantEvent
compliance.
An operation
Host operation Based on event
Information Automatic performed on the host
cancelled CanceledHostOperationEvent
was canceled.
This event indicates
Based on event
Host operation timed that an operation
TimedOutHostOperationEven Warning Manual
out performed on the host
t
timed out.
Based on event
Host primary agent the primary agent
HostPrimaryAgentNotShortN Warning Manual
not in short name specified is not a short
ameEvent
name.
Based on event
Resolve This event records a
HostConnectedEvent
Host reconnection failed attempt to re-
Based on event Automatic
failed establish a host
HostReconnectionFailedEven Error connection.
t
Based on event
vprob.net.redundancy.lost The event indicates
Based on event that one or more
vprob.net.redundancy.degra portgroups in the host
ded has lost a redundant
Warning uplink to the physical
Based on event
network. Portgroups
Host redundancy esx.problem.net.redundancy.l
Automatic are still connected.
failure ost
However this may be
Based on event the last redundant
esx.problem.net.redundancy. uplink. Check the event
degraded description and
Based on event context to confirm the
esx.clear.net.redundancy.rest Resolve status.
ored
Based on event
Host short name host name resolution
HostShortNameInconsistentE Warning Manual
inconsistent returned different
vent
names on the host.
Based on event
Host short name IP the host's short name
HostShortNameToIpFailedEve Warning Manual
resolve failed could not be resolved
nt
to an IP address.
Average memory swap used
Warning
for 15 minutes is above 64 MB
This host is swapping
Host swap memory Average memory swap used Automatic
too much memory.
for 15 minutes is above 128 Error
MB
Host synchronization Based on event failure to sync up with
Warning Manual
failed HostSyncFailedEvent the vCenter Server
agent on the host.
failure to connect to a
Host upgrade Based on event
Error Manual host due to an
connection failure HostUpgradeFailedEvent
installation or upgrade
issue.

Resolve
Action

the host did not
Based on event
Incorrect host provide the
IncorrectHostInformationEve Warning Manual
information information needed to
nt
acquire the correct set
of licenses.
The iSCSI initiator is
Based on event
iSCSI target storage unable to establish a
esx.problem.storage.iscsi.targ Error Manual
connection failure connection to the
et.connected.error
target.
The
esx.problem.storage.isc
iSCSI targets are Based on event si.target.permanently.r
permanently esx.problem.storage.iscsi.targ Error Manual emoved message is
removed from ESXi et.permanently.lost received when an iSCSI
target is no longer
presented to ESXi.
Based on event ESX(i) host is missing
Isolation addresses is
com.vmware.vc.HA.HostHasN Warning Manual isolation addresses for
missing
oIsolationAddrsDefined isolation detection.
In vSphere 5.1, rollback
is enabled by default.
However, you can
enable or disable
rollbacks at the
vCenter Server level.
Several networking
events can trigger a
Network rollback Based on event rollback. The events are
Error Manual
detected NetworkRollbackEvent grouped into these
categories:
Host networking
rollbacks (virtual
switches or network
system)
Distributed switch
rollbacks
This event records the
Based on event fact that a host does
No host network for
HostNoAvailableNetworksEve Warning Manual not have any available
HA available
nt networks for HA
communication.
A potential
misconfiguration or I/O
performance issue
caused by a non-ESX
workload has been
detected. This alarm is
Based on event triggered when
Non VI workload
EsxProblemIormNonViWorklo Error Manual Storage I/O Control
detected on host
ad (SIOC) detects that a
workload that is not
managed by SIOC is
contributing to I/O
congestion on a
datastore that is
managed by SIOC.

Resolve
Action
An invalid storage
Based on event
SCSI unsupported module attempted to
esx.problem.scsi.unsupported Warning Manual
plugin warning configure a SCSI
.plugin.type
device.
Based on event
vprob.storage.connectivity.lo
st The event indicates a
Error loss in connectivity to
Based on event
Storage connection the specified storage
esx.problem.storage.connecti Automatic
failure device. The path
vity.lost
indicated is the last
Based on event path that went down.
esx.clear.storage.connectivity. Resolve
restored
Based on event
vprob.storage.redundancy.los
t
Based on event A host has lost a path
vprob.storage.redundancy.de to access the specified
graded storage and the path
Warning
Based on event to storage is either
Storage connection
esx.problem.storage.redunda Automatic degraded, or no longer
redundancy failure
ncy.degraded redundant. Check the
Based on event event description and
esx.problem.storage.redunda context to confirm the
ncy.lost status.
Based on event
esx.clear.storage.redundancy. Resolve
restored
The teaming
configuration of the
Teaming mismatch Based on event uplink ports in the DVS
Error Manual
error TeamingMisMatchEvent does not match
physical switch
configuration.
Based on event MTU health check
Uplink port MTU
UplinkPortMtuNotSupportEv Error Manual status of an uplink port
error
ent is changed.
Based on event Vlans health check
Uplink port VLAN
UplinkPortVlanUntrunkedEve Error Manual status of an uplink port
error
nt is changed.
Based on event
HostConnectionLostEvent
Error vCenter Server has lost
vCenter Server lost Based on event
Automatic connection to this
connection to host HostCnxFailed
host.
Based on event
Resolve
HostConnectedEvent
This event records an
vMotion license Based on event
Error Manual expired vMotion
expired VMotionLicenseExpiredEvent
license.

Resolve
Action
A larger MTU
(maximum
transmission unit)
bring greater efficiency
because each packet
carries more user data
while protocol
overheads; the
resulting higher
efficiency means a
slight improvement in
bulk protocol
vSphere Distributed throughput. A larger
Based on event
Switch MTU Error Manual MTU also means
MtuMismatchEvent
mismatch processing of fewer
packets for the same
amount of data.
However, this gain is
not without some
downside. Large
packets can occupy a
slow link for some
time, causing greater
delays to following
packets and increasing
lag and minimum
latency.
Virtual Machine
Resolve
Action
The customization
Based on event
Customization sequence failed
CustomizationUnknownFailu Warning Manual
unknown failure unexpectedly in
re
the guest.
This event records
Based on event
Fault Tolerance VM a secondary or
VmFaultToleranceVmTermin Warning Manual
terminated primary VM is
atedEvent
terminated.
This event records
Based on event
FT VM Failover Error Manual a fault tolerance
VmPrimaryFailoverEvent
failover.
The customization
sequence in the
Guest customization Based on event guest failed.
Warning Manual
failure CustomizationFailed Cannot complete
customization of
VM.
Guest disk free space space is
Warning Guest OS volume
below 10%
Guest disk space Automatic is low on available
Guest disk free space space is guest disk space.
Error
below 5%

Resolve
Action
The event records

an error occurred
HA agent update Based on event when updating
Error Manual
failed VmDasUpdateErrorEvent the HA agents
with the current
state of the VM.
The heartbeat is
the
communication to
the VMware tools
heartbeat running
inside the VM.
Heartbeat can only
be monitored
Heartbeat is missing Heartbeat not detected for
Error Automatic when the VMware
for VM 15 minutes
tools are installed
in a VM. The
heartbeat is what
vCenter Server
uses to determine
the general health
and availability of
a running VM.
Average memory balloon There is high
percent for 15 minutes is Warning utilization of the
above 10% VMware Tools
High balloon memory memory
Automatic
utilization Average memory balloon controller, also
percent for 15 minutes is Error known as the
above 50% 'balloon driver',
within this VM.
Average memory usage for There is high
Warning
15 minutes is above 90% utilization of
memory within
this Virtual
Machine. The
memory active
High memory usage Automatic metric is the
Average memory usage for current
Error
15 minutes is above 95% percentage of
memory active vs.
memory
maximum for this
VM.
The age of the
(latest) snapshot
for this Virtual
VM snapshot age is 48 hour
Latest snapshot age Warning Automatic Machine has
or more
exceeded the
configured
threshold.
VM snapshot size is above The VM has been
Latest snapshot size Warning Automatic
10% running on a

Resolve
Action
snapshot for
extended period
of time, which
exceeded the
configured
threshold for the
snapshot file size.
A snapshot
VM snapshot size is above preserves the state
Error
20% and data of a VM
at a specific point
in time, and is
typically used for
backup of running
VMs or
maintenance
activities (such as
patching).
Based on event
Linux customization Failed to set Linux
CustomizationLinuxIdentityF Warning Manual
identity failure identity.
ailed
Network setup
Network Based on event
failed in the guest
customization setup CustomizationNetworkSetup Warning Manual
during
failure Failed
customization.
This event records
that no
compatible host
was found to place
Based on event a secondary VM. A
No compatible host
VmNoCompatibleHostForSec Warning Manual default alarm will
for Secondary VM
ondaryEvent be triggered upon
this event, which
by default, would
trigger a SNMP
trap.
This event records
No host for a virtual Based on event a VM for which no
Warning Manual
machine available VmOrphanedEvent host is
responsible.
This event records
that DRS did not
recommend a
No maintenance
Based on event migration for a
mode DRS
NoMaintenanceModeDrsRec Warning Manual powered on VM,
recommendation for
ommendationForVM even though its
VM
host is going into
maintenance
mode.
This event records
a migration failure
when the
No network access for Based on event
Warning Manual destination host is
VM migration VmNoNetworkAccessEvent
not on the same
network as the
source host.

Resolve
Action
This event records

Based on event when the HA does
Not enough
NotEnoughResourcesToStart Warning Manual not find sufficient
resources for failover
VmEvent resources to
failover a VM.
This VM is running
Orphaned VM backup
Orphaned VM backup on the snapshot
snapshot age is 60 minutes Error Automatic
snapshot left by backup or
or more
replication job.
Average CPU usage is above
70.0% and datastore write Warning Veeam ONE
Possible ransomware rate is 40 MB/s for 5 minutes. detected
Automatic
activity Average CPU usage is above suspicious activity
80.0% and datastore write Error on this VM.
rate is 60 MB/s for 5 minutes.
This event is
recorded after a
Based on event failover of the new
Secondary VM config
VmFailedUpdatingSecondary Warning Manual primary VM failed
update failed
Config to update the
config of the
secondary VM.
The Secondary VM
cannot be
Based on event powered on as
Secondary VM failed
VmFailedStartingSecondaryE Warning Manual there are no
to start
vent compatible hosts
that can
accommodate it.
This event records
Based on event
Secondary VM start timeout when
VmTimedoutStartingSecond Warning Manual
timeout starting a
aryEvent
secondary VM.
Sysprep failed to
run in the guest
during
customization.
This might have
Sysprep Based on event
Warning Manual been caused by
customization failure CustomizationSysprepFailed
the fact that the
wrong sysprep
was used for the
guest or errors in
the sysprep file.
Number of VM snapshots is 3 An excessive
Warning
or more number of
snapshots in a
chain has been
Too many snapshots detected on the
Automatic
on the VM Number of VM snapshots is 5 VM which may
Error lead to decreased
or more
virtual machine
and host
performance.
This event records
Virtual disk creation Based on event a failure to create a
Error Manual
failed VmDiskFailedEvent virtual disk in a
VM.

Resolve
Action
This event records

VM clone operation Based on event
Error Manual a failure to clone a
failure VmCloneFailedEvent
VM.
This event records
if the
VM configuration file Based on event
Warning Manual configuration file
missing VmConfigMissingEvent
(VMX file) for a VM
cannot be found.
Based on event
Error This VM is
VM connection VmDisconnectedEvent
Automatic 'Disconnected' in
failure Based on event
Resolve vCenter Server.
VmConnectedEvent
Based on event When initiating
com.vmware.vc.VmDiskCons Error Delete or DeleteAll
olidationNeeded operations on
Based on event snapshots, the
com.vmware.vc.VmDiskCons Resolve snapshot details
olidationNoLongerNeeded are deleted from
Snapshot
Manager, then the
snapshot files are
consolidated and
merged to another
snapshot file or to
the virtual
VM consolidation
Automatic machine parent
needed status
disk. If the
Based on event consolidation fails,
com.vmware.vc.VmDiskCons Resolve there were no
olidatedEvent snapshots shown
in the Snapshot
Manager, but the
snapshot files
were still being
used on the
datastore. This can
cause the
datastore to run
out of space.
Average CPU ready all cores
metric for 15 minutes is Warning This VM has
above 10% exceeded the
VM CPU ready Automatic
Average CPU ready all cores threshold for CPU
metric for 15 minutes is Error Ready Percent.
above 20%
Average CPU usage for 15 This VM has
Warning
minutes is above 75% exceeded the
VM CPU usage Automatic
Average CPU usage for 15 threshold for CPU
Error usage.
Based on event
com.vmware.vc.VmDiskFaile Error There is an issue
VM disk dToConsolidateEvent with the disk for
Automatic
consolidation failure Based on event this virtual
com.vmware.vc.VmDiskCons Resolve machine.
olidatedEvent
Average number of datastore This VMGuest disk
VM disk SCSI
command aborts for 15 Warning Automatic connection (LUN)
connection failures
minutes is above 2 has logged one or

Resolve
Action
Average number of datastore more SCSI aborts.

command aborts for 15 Error
minutes is above 6
Average number of datastore
bus resets for 15 minutes is Warning This VMGuest disk
above 2 connection (LUN)
VM disk SCSI
Automatic has logged one or
connection resets Average number of datastore more SCSI bus
bus resets for 15 minutes is Error resets.
above 6
This is a generic
event for error
messages from a
Based on event
VM generic error Error Manual VM that do not fit
VmMessageErrorEvent
into any other
specific vCenter
Server event.
This is a generic
event for warning
messages from a
Based on event
VM generic warning Warning Manual VM that did not fit
VmMessageWarningEvent
into any other
specific vCenter
Server event.
This is a VM guest
Based on event
VM guest reboot Information Automatic reboot request
VmGuestRebootEvent
event.
This is a VM guest
Based on event
VM guest shutdown Information Automatic shutdown request
VmGuestShutdownEvent
event.
vSphere HA has
Based on event
failed to restart
VM HA error com.vmware.vc.HA.FailedRes Error Manual
after a host
tartAfterIsolationEvent
isolation.
This event records
when a VM is
reset by HA VM
Health Monitoring
Based on event on hosts that do
VM HA reset Warning Manual
VmDasBeingResetEvent not support the
create screenshot
APIi or if the create
screenshot API
fails.
This event records
when HA VM
Based on event
VM HA reset failure Warning Manual health monitoring
VmDasResetFailedEvent
fails to reset a VM
after failure.
Average memory swapped This VM has
for 15 minutes is above 64 Warning exceeded the
VM memory swap MB threshold for
Automatic
usage Average memory swapped memory swapping
for 15 minutes is above 128 Error to disk within the
MB host.

Resolve
Action
The power state of

a VM indicates
State not equals Running for
VM power status Error Automatic whether the VM is
5 minutes or more
active and
functional.
Based on event This event records
VM resetting Information Automatic
VmResettingEvent a VM resetting.
This event records
that the VM was
Based on event
VM restart on restarted on a
VmRestartedOnAlternateHos Information Automatic
alternate host host, since its
tEvent
original host had
failed.
This event records
when a VM is reset
Based on event by HA VM health
VM Screenshot HA
VmDasBeingResetWithScree Warning Manual monitoring on
reset
nshotEvent hosts that support
the create
screenshot API.
Average datastore highest
latency for 15 minutes is Warning Highest latency
above 50 milliseconds value across all
VM total disk latency Automatic
Average datastore highest disks used by the
latency for 15 minutes is Error VM.
above 75 milliseconds
This VM has not
been backed up
No backup restore points for within the defined
VM with no backups Warning Automatic
the past 24 hours RPO (Recovery
Point Objective)
interval.
This VM has not
been replicated
No replica restore points for within the defined
VM with no replica Warning Automatic
the past 24 hours RPO (Recovery
Point Objective)
interval.
This event records
Based on event a conflict of VM
VM WWN conflict Error Manual
VmWwnConflictEvent WWNs (World
Wide Name).
VMware VM tools state
Warning
changes equals Unknown
VMware VM tools state There is a problem
Warning
VMware VM tools changes equals Out-of-date with VMware Tools
Automatic
state VMware VM tools state in this Virtual
Error Machine.
changes equals Not installed
Error
changes equals Not running

Datastore
Resolve
Action
Free space is below 10% Warning Datastore is low on

Datastore free
Automatic available free
space Free space is below 5% Error space.
The event indicates
a loss in
connectivity to the
Datastore is State not equals Accessible for 5 specified storage
Error Automatic
inaccessible minutes or more device. The path
indicated is the last
path that went
down.
Datastore provisioning rate is
Warning
Datastore over- above 400% Datastore is over-
Automatic
allocation Datastore provisioning rate is allocated.
Error
above 600%
Maximum datastore read latency
for 15 minutes is above 100 Warning Datastore latency
Datastore read milliseconds has exceeded the
Automatic
latency Maximum datastore read latency threshold of total
for 15 minutes is above 250 Error read latency.
milliseconds
Maximum datastore write latency
for 15 minutes is above 100 Warning Datastore latency
Datastore write milliseconds has exceeded the
Automatic
latency Maximum datastore write latency threshold of total
for 15 minutes is above 250 Error write latency.
milliseconds
Locker has not
been configured
Locker Based on event properly. Datastore
Warning Manual
misconfiguration LockerMisconfiguredEvent which is configured
to back the locker
does not exist.
Any VMware Object
Resolve
Action
This event records

that a duplicate IP
address has been
observed, with
Duplicate IP
Based on event conflict between
address Warning Manual
DuplicateIpDetectedEvent VM, and the
detected
vMotion or IP
storage interface
configured on the
host.
This event records
Host cluster Based on event
Information Automatic when a cluster is
destroyed ClusterDestroyedEvent
destroyed.

Resolve
Action
This event records

Host failure Based on event when a host failure
Error Manual
detected DasHostFailedEvent has been detected
by HA.
This event records
that a host has
been isolated from
the network in a HA
cluster. Since an
isolated host
cannot be
Host isolation Based on event
Warning Manual distinguished from
in HA cluster DasHostIsolatedEvent
a failed host except
by the isolated host
itself, this event is
logged when the
isolated host
regains network
connectivity.
This event records
the fact that a host
does not have a
No host redundant
redundant Based on event management
management HostNoRedundantManagementNet Warning Manual network. It is
network workEvent recommended that
available host management
networks be
configured with
redundancy.
This event records
that vCenter Server
Primary host
Based on event has re-established
connection re- Information Automatic
DasAgentFoundEvent contact with a
established
primary host in this
HA cluster.
Based on event This event records
Error
DasAgentUnavailableEvent that vCenter Server
cannot contact to
any primary host in
this HA cluster.
vCenter Server has
lost contact with all
primary nodes with
a connected state.
Attempts to
Primary host
Automatic configure HA on a
unavailable Based on event
Resolve host in this cluster
DasAgentFoundEvent will fail until a
DasAgentFoundEve
nt is logged or
unless this is the
first node to be
configured. For
example, if all the
other hosts are
disconnected first.

Resolve
Action
This event records

when a conflict
Resource pool
Based on event with a resource
configuration Error Manual
ResourceViolatedEvent pool's resource
conflict
configuration is
detected.
In a shared storage
environment, when
multiple hosts
access the same
VMFS datastore,
specific locking
mechanisms are
used. These locking
mechanism
prevent multiple
hosts from
concurrently
writing to the
metadata and
ensure that no data
corruption occurs.
Storage ATS Based on event
Error Manual VMFS supports SCSI
support failure esx.problem.vmfs.ats.support.lost
reservations and
atomic test and set
(ATS) locking. For
storage devices
that support
hardware
acceleration, VMFS
uses the ATS
algorithm, also
called hardware
assisted locking. In
contrast with SCSI
reservations, ATS
supports discrete
locking per disk
sector.
This event records
when a task
Task timeout Based on event
Warning Manual exceeds defined
reached TaskTimeoutEvent
timeout in vCenter
Server.
Template
Based on event failure to deploy a
deployment Error Manual
VmDeployFailedEvent VM from a
failure
template.
Based on event
Warning This event records a
VM instance VmInstanceUuidConflictEvent
Automatic conflict of VM
UUID conflict Based on event
Resolve instance UUIDs.
VmInstanceUuidChangedEvent
Based on event
VmMacConflictEvent
VM MAC Error This event records a
Based on event
address Automatic MAC address
VmStaticMacConflictEvent
conflict conflict for a VM.
Based on event
Resolve
VmMacChangedEvent

Resolve
Action
Based on event
Error
vprob.vmfs.error.volume.is.locked
Based on event The alarm indicates
vCenter
esx.problem.vmfs.error.volume.is.loc Error that a VMFS
storage ked Manual volume on the
availability
Based on event ESX(i) host is locked
error Warning
vprob.vmfs.extent.offline due to an I/O error.
Based on event
Warning
esx.problem.vmfs.extent.offline
There is an issue
vSphere Based on event with VMware high-
cluster HA com.vmware.vc.HA.HostDasErrorEve Error Manual availability
error nt configuration for
this host.
Based on event
com.vmware.vc.HA.InvalidMaster
Based on event
com.vmware.vc.HA.UserHeartbeatD
atastoreRemoved
Based on event
com.vmware.vc.HA.VcCannotFindM
asterEvent
There is an issue
Based on event
vSphere with VMware high-
com.vmware.vc.HA.HostPartitionedF
cluster HA Warning Manual availability
romMasterEvent
warning protection for this
Based on event cluster.
com.vmware.vc.HA.HostUnconfigure
dWithProtectedVms
Based on event
com.vmware.vc.HA.HostUnconfigure
Error
Based on event
com.vmware.vc.HA.NotAllHostAddrs
Pingable
Resolve
Action
vCloud Director object task status

Warning
vApp health equals Alert vApp health status
Automatic
status vCloud Director object task status has changed
Error
equals Warning
vApp runtime lease timeout is 14 vApp runtime lease
vApp runtime Warning Automatic
days has expired. Once a

Resolve
Action
lease timeout vApp is powered
on for the first time,
the clock starts for
the Maximum
Runtime Lease. The
vApp runtime lease timeout is 7 days Error Maximum Runtime
Lease is how long a
vApp can be
powered on before
its automatically
suspended
vApp storage lease timeout is 14 vApp storage lease
Warning
days has expired. A vApp
storage lease
vApp storage begins when a user
Automatic
lease timeout stops the vApp.
vApp storage lease timeout is 7 days Error Storage leases do
not affect running
vApps
Resolve
Action
Number of blocking tasks is 1 or

Organization Warning Some tasks are in a
more
blocking task Automatic pending state as a
Number of blocking tasks is 5 or result of blocking.
number Error
more
Blocking tasks timeout is 5 minutes Warning One or more
Organization
organization
blocking task Blocking tasks timeout is 10 Automatic
Error blocking tasks has
timeout minutes expired
Resolve
Action
Network pool usage is above 90% Warning Network pool

usage has
Network pool exceeded the
Automatic
usage Network pool usage is above 95% Error configured
threshold for this
alarm
Average CPU usage for 15 minutes is This organization
Warning
Org VDC CPU above 80% VDC has exceeded
Automatic
usage Average CPU usage for 15 minutes is the threshold for
Error CPU Usage
above 90%
Warning
Org VDC equals Warning Org VDC health
Automatic
health status vCloud Director object task status status has changed
Error
equals Alert
Average memory usage for 15 minutes This organization
Org VDC Warning Automatic
is above 80% VDC has exceeded

Resolve
Action
memory usage Average memory usage for 15 minutes the threshold for
Error Memory Usage
is above 90%
Average storage usage for 15 minutes This org VDC has
Warning
Org VDC is above 80% exceeded the
Automatic
storage usage Average storage usage for 15 minutes threshold for
Error Storage Usage
is above 90%
Resolve
Action
Average CPU usage for 15 minutes is This provider VDC

Warning
Provider VDC above 80% has exceeded the
Automatic
CPU usage Average CPU usage for 15 minutes is threshold for CPU
Error Usage
above 90%
Warning Provider VDC
Provider VDC equals Warning
Automatic health status has
health status vCloud Director object task status
Error changed
equals Alert
Average memory usage for 15 minutes This provider VDC
Warning
Provider VDC is above 80% has exceeded the
Automatic
memory usage Average memory usage for 15 minutes threshold for
Error Memory Usage
is above 90%
This provider VDC
Provider VDC Average storage usage for 15 minutes has exceeded the
Warning Automatic
storage usage is above 80% threshold for
Storage usage

Microsoft Hyper-V Alarms
This section describes predefined alarms for Microsoft Hyper-V infrastructure components:
Host
Virtual Machine
Cluster
Cluster Shared Volume
Local Storage
Any Hyper-V Object
Host
Resolve
Action

failed user logon
attempt. The
combination of
username,
password and
Bad Hyper-V Based on event
permissions is the
username logon 4625 Microsoft-Windows-Security- Error Manual
mechanism by
attempt Auditing
which Hyper-V
server authenticate
a user for access
and authorize the
user to perform
activities.
Host mode failed to
Cluster Based on event establish a
communication 1570 Microsoft-Windows- Error Manual communication
session failed FailoverClustering session while
joining the cluster.
This cluster node
has no network
Cluster host
Based on event connectivity. It
node network
1554 Microsoft-Windows- Error Manual cannot participate
connectivity
FailoverClustering in the cluster until
error
connectivity is
restored.
Host node has
established a
communication
session with
Cluster hosts Based on event another node and
update version 1548 Microsoft-Windows- Error Manual detected that it is
mismatch FailoverClustering running a different
but compatible
version of the
cluster service
software.
Based on event Cluster network
Cluster network
1127 Microsoft-Windows- Warning Manual interface for cluster
failure
FailoverClustering node has failed.

Resolve
Action
The cluster service

detected a problem
with the witness
resource. The
witness resource
Based on event
Cluster witness will be failed over
1558 Microsoft-Windows- Error Manual
resource failure to another node
FailoverClustering
within the cluster in
an attempt to
reestablish access
to cluster
configuration data.
Cluster service
failed to update the
Cluster witness Based on event
cluster
resource update 1557 Microsoft-Windows- Error Manual
configuration data
failure FailoverClustering
on the witness
resource.
Average Hyper-V Services memory
Warning
Host available usage for 15 minutes is above 80% This host is low on
Automatic
memory Average Hyper-V Services memory available memory.
Error
usage for 15 minutes is above 90%
Average disk queue length for 15 Average disk queue
Warning
minutes is above 1 length on the host
may report on too
many I/O requests.
This means that not
Host average all requests are
disk queue Automatic queued. Some
Average disk queue length for 15 requests are
length Error
minutes is above 2 completed and are
on their way back
to where the
performance data
is being collected.
Average pressure for 15 minutes is This host has
Host average Warning
above 90% exceeded the
memory Automatic
Average pressure for 15 minutes is threshold for
pressure Error
above 100% memory pressure.
The Cluster service
Based on event cannot identify
Host cluster
1093 Microsoft-Windows- Error Manual host node as a
membership
FailoverClustering member of failover
cluster.
This alarm monitors
Host connection State not equals Connected for 5
Error Automatic Hyper-V host
failure minutes or more
connection state.
Average host CPU wait time for 15 The counter shows
Host CPU time Warning Automatic
minutes is 60 microseconds the average time

Resolve
Action
per dispatch Virtual Machines
running on the
host spent waiting
for a virtual
processor to be
dispatched onto a
Average host CPU wait time for 15
Error logical processor.
minutes is 100 microseconds
More vCPUs on
host means more
things the
dispatcher has to
schedule thus wait
time raises.
Average Total Run Time value for 15 This host has
Warning
Host CPU usage Automatic
Average Total Run Time value for 15 threshold for CPU
Error usage.
Based on event Host node failed to
Host failed to
1546 Microsoft-Windows- Error Manual form a failover
form a cluster
FailoverClustering cluster.
The service
required to manage
Host Image virtual storage is
*Hyper-V Image Management*
Management not running. No
service is not running for 5 minutes or Error Automatic
service is not virtual storage
more
running management
operations can be
performed.
Average pages/sec value for 15 The counter shows
Warning
minutes is above 500 the rate at which
pages are read
from or written to
disk to resolve hard
Host Memory
Automatic page faults. This
Pages Usage Average pages/sec value for 15
Error counter is a primary
minutes is above 1500 indicator of the
types of faults that
cause system-wide
delays.
Average network output queue This host has
Warning
length for 15 minutes is above 1 exceeded the
Host network threshold for the
average output Automatic length of the queue
Average network output queue in packets. This
queue length Error
length for 15 minutes is above 2 counter should be
0 at all times.
Average network outbound errors This host has
Warning
number for 15 minutes is above 1 exceeded the
Host network threshold for the
outbound Automatic outbound packets
Average network outbound errors that couldn't be
errors number Error
number for 15 minutes is above 2 transmitted
because of errors.

Resolve
Action
The Hyper-V
Networking
Management
Host
Service is not
Networking *Hyper-V Networking Management*
configured to start
Management service is not running for 5 minutes or Error Automatic
automatically.
service is not more
Virtual networks
running
cannot be
managed until the
service is started.
Host node Based on event
Host node failed to
failed to form a 1573 Microsoft-Windows- Error Manual
form a cluster.
cluster FailoverClustering
Host node failed to
join the cluster
because it could
Host node Based on event
not send and
failed to join 1572 Microsoft-Windows- Error Manual
receive failure
detection network
messages with
other cluster nodes.
Cluster host node
Host node was Based on event
has been evicted
evicted from 1011 Microsoft-Windows- Warning Manual
from the failover
cluster.
Cluster node was
removed from the
active failover
cluster
Host node was Based on event membership. If the
removed from 1135 Microsoft-Windows- Error Manual Cluster service fails
cluster FailoverClustering to start on a failover
cluster node, the
node cannot
function as part of
the cluster.
Host operation
Based on event system has been
Host restart Information Automatic
1074 User32 restarted or shut
down.
The cluster service
has determined
that this node does
not have the latest
Missing latest
Based on event copy of cluster
cluster
1561 Microsoft-Windows- Error Manual configuration data.
configuration
FailoverClustering Therefore, the
data
cluster service has
prevented itself
from starting on
this node.
Cluster node lost
communication
Network Based on event with another
communication 1592 Microsoft-Windows- Warning Manual cluster node.
failure FailoverClustering Network
communication
was reestablished.

Resolve
Action
Cluster network
interface for cluster
node is
Unreachable Based on event
unreachable by at
cluster network 1126 Microsoft-Windows- Warning Manual
least one other
interface FailoverClustering
cluster node
attached to the
network.
The service
required to manage
Virtual Machine virtual machines is
Management *Hyper-V Virtual Machine not running. No
Error Automatic
service is not Management* service is not running virtual machine
running management
operations can be
performed.
Virtual Machine
Resolve
Action
The parent virtual

hard disks
Background Based on event associated with
disk merge 19100 Microsoft-Windows-Hyper-V- Warning Manual this virtual
failed VMMS machine may be
in an inconsistent
state.
Background Based on event The snapshot
disk merge 19090 Microsoft-Windows-Hyper-V- Warning Manual merge operation
interruption VMMS was interrupted.
The configuration
Checkpoint Based on event
of checkpoint is
configuration is 16420 Microsoft-Windows-Hyper-V- Error Manual
no longer
not accessible VMMS
accessible.
Average memory pressure for 15 This VM has
Current Warning
memory Automatic
Average memory pressure for 15 threshold for
pressure Error
minutes is above 100% memory pressure.
Dynamic MAC
Failed to assign Based on event
address for VM
dynamic MAC 12572 Microsoft-Windows-Hyper-V- Error Manual
network adapter
address SynthNic
was not assigned.
Failed to create Based on event Failed to create
memory 3320 Microsoft-Windows-Hyper-V- Error Manual memory contents
contents file Worker file.
Failed to create Based on event Failed to create or
VM saved state 3080 Microsoft-Windows-Hyper-V- Error Manual access VM saved
file Worker state file.
Based on event
Failed to delete Cannot delete VM
16150 Microsoft-Windows-Hyper-V- Warning Manual
VM directory directory.
VMMS
Failed to Based on event
Failed to initialize
initialize VM 3050 Microsoft-Windows-Hyper-V- Error Manual
VM memory.
memory Worker

Resolve
Action
Cannot merge
disk file on
Based on event deletion. As a
Failed to merge
16210 Microsoft-Windows-Hyper-V- Warning Manual result, this disk
virtual disk
VMMS might be in
inconsistent
state.
Based on event
12010 Microsoft-Windows-Hyper-V-
Worker
Based on event
Failed to power Worker Failed to power
Error Manual
on VM Based on event on VM.
Worker
Based on event
Worker
Based on event
Failed to Failed to restore a
12080 Microsoft-Windows-Hyper-V- Error Manual
restore VM VM.
Worker
Based on event
Failed to save Failed to save
VM state for a VM.
Worker
Guest disk free space is below 10% Warning Guest OS volume
Guest disk is low on
Automatic
space Guest disk free space is below 5% Error available guest
disk space.
The age of the
checkpoint
Hyper-V VM (latest) for this
VM checkpoint age is 48 hours or more Warning Automatic
checkpoint age VM has exceeded
the configured
threshold.
Hyper-V VM checkpoint size is above The VM has been
Warning
10% of the VM size running on a
checkpoint for
extended period
of time, which
exceeded the
Hyper-V VM configured
Automatic
checkpoint size Hyper-V VM checkpoint size is above threshold for the
Error checkpoint size. A
20% of the VM size
checkpoint
preserves the
state and data of
a VM at a specific
point in time.
The version of a
component of
Incompatible
Based on event integration
version of
4010 Microsoft-Windows-Hyper-V- Warning Manual services is
integration
Integration incompatible
services
with another
version.

Resolve
Action
Hyper-V disk
Based on event
Insufficient space is low on
disk space available free
VMMS
space.
Based on event
12560 Microsoft-Windows-Hyper-V- By default, new
SynthNic virtual machines
Based on event in Hyper-V are
Invalid static
12560 Microsoft-Windows-Hyper-V- Error Manual created with NICs
MAC address
Worker that are assigned
Based on event dynamic MAC
12560 Microsoft-Windows-Hyper-V- addresses.
VMMS
Failure in
Machine Based on event machine
remoting 12480 Microsoft-Windows-Hyper-V- Warning Manual remoting system
system failure Worker has been
detected.
VM has been
Based on event
No disk space paused because it
to run this VM has run out of
VMMS
disk space.
Based on event
3122 Microsoft-Windows-Hyper-V- Hyper-V was
Not enough
Worker unable to allocate
memory to Error Manual
Based on event RAM resources to
start a VM
3030 Microsoft-Windows-Hyper-V- start this VM.
Worker
Total run time is above 70% and virtual
storage write is above 40 MB/s for 5 Warning Veeam ONE
Possible minutes. detected
ransomware Automatic suspicious
Total run time is above 80% and virtual activity on this
activity
storage write is above 60 MB/s for 5 Error VM.
minutes.
Based on event By default, new
12562 Microsoft-Windows-Hyper-V- virtual machines
SynthNic in Hyper-V are
Static MAC
Warning Manual created with NICs
address conflict Based on event that are assigned
12562 Microsoft-Windows-Hyper-V- dynamic MAC
Worker addresses.
Based on event This VM has
Unexpected
16020 Microsoft-Windows-Hyper-V- Error Manual encountered an
VM error
VMMS unexpected error.
Based on event
16410 Microsoft-Windows-Hyper-V- The configuration
VM VMMS of virtual machine
configuration is Error Manual
Based on event is no longer
not accessible
16400 Microsoft-Windows-Hyper-V- accessible.
VMMS
The VM
VM Based on event
configuration is
configuration 4096 Microsoft-Windows-Hyper-V- Error Manual
no longer
module error Config
accessible.
Average guest run time for 15 minutes This VM has
VM CPU usage Warning Automatic
is above 75% exceeded the

Resolve
Action
Average guest run time for 15 minutes threshold for CPU

Error usage.
is above 85%
Average number of errors/min for 15 This VM has
Warning
minutes is above 4 logged one or
VM disk errors Automatic more errors that
Average number of errors/min for 15 have occurred on
Error
minutes is above 8 its virtual device.
Virtual Machine
was rebooted.
This warning is
Based on event
VM guest OS applied only to
18514 Microsoft-Windows-Hyper-V- Information Warning
reboot Windows Server
Worker
2012 and
Windows Server
2012 R2.
VM Based on event
VM initialization
initialization 3040 Microsoft-Windows-Hyper-V- Error Manual
has failed.
error Worker
VM invalid Based on event The virtual
switch port 12570 Microsoft-Windows-Hyper-V- Error Manual machine cannot
reference SynthNic be started.
Virtual Machine
was rebooted.
This warning is
Based on event
applied only to
VM restart 18512 Microsoft-Windows-Hyper-V- Information Automatic
Windows Server
Worker
2012 and
Windows Server
2012 R2.
Virtual Machine
was shut down.
This warning is
Based on event
VM shutdown applied only to
18508 Microsoft-Windows-Hyper-V- Information Automatic
by guest Windows Server
Worker
2012 and newer
Windows server
versions.
Virtual Machine
was shut down.
This warning is
Based on event
VM shutdown applied only to
18504 Microsoft-Windows-Hyper-V- Information Automatic
by host Windows Server
Worker
2012 and newer
Windows server
versions.
Average CPU wait time for 15 minutes is The counter
Warning
above 60 microseconds shows the
average time
spent waiting for
VM vCPU time
Automatic a virtual
per dispatch Average CPU wait time for 15 minutes is
Error processor to be
above 100 microseconds dispatched onto
a logical
processor.

Resolve
Action
This VM has not

been backed up
within the
VM with no No backup restore points for the past
Warning Automatic defined RPO
backups 24 hours
(Recovery Point
Objective)
interval.
This VM has not
been replicated
within the
VM with no No replica restore points for the past 24
Warning Automatic defined RPO
replica hours
(Recovery Point
Objective)
interval.
Based on event
10102 Microsoft-Windows-Hyper-V- Error
VMMS Failed to create
VSS checkpoint
Manual the backup of
failure Based on event virtual machine.
15252 Microsoft-Windows-Hyper-V- Error
VMMS
Cluster
Resolve
Action
An attempt to
forcibly start the
cluster service
has failed
Cluster
Based on event because the
configuration
1575 Microsoft-Windows- Error Manual cluster
data is missing
FailoverClustering configuration
or corrupt
data on host
node is either
missing or
corrupt.
The failover
cluster database
could not be
unloaded and
any potentially
incorrect
Cluster changes in
configuration Based on event memory could
database 1593 Microsoft-Windows- Error Manual not be
cannot be FailoverClustering discarded. The
unloaded cluster service
will attempt to
repair the
database by
retrieving it from
another cluster
node.

Resolve
Action
The cluster
database could
not be loaded.
Cluster Based on event Ensure that a
database could 1057 Microsoft-Windows- Error Manual good copy of
not be loaded FailoverClustering the cluster
configuration is
available to the
node.
Based on event When placing a
Resolve
VeeamHvClusterReserveStateOkEvent virtual machine
in a failover
cluster, the
placement
process
calculates
Cluster whether the
memory new virtual
Based on event Automatic
overcommitme machine will
VeeamHvClusterReserveStateErrorEven Error over-commit the
nt
t cluster. If the
action will over-
commit the
cluster, the
corresponding
alarm will be
fired.
Cluster Based on event
Cluster network
network is 1130 Microsoft-Windows- Warning Manual
is down.
down FailoverClustering
Cluster network
name resource
cannot be
brought online.
Cluster
Based on event The computer
resource
1207 Microsoft-Windows- Error Manual object
cannot be
FailoverClustering associated with
brought online
the resource
could not be
updated in
domain.
Cluster resource
Based on event in clustered
Cluster
1069 Microsoft-Windows- Error Manual service or
resource failure
FailoverClustering application has
failed.
The Cluster
service cannot
be started. An
Cluster service Based on event
attempt to read
cannot be 1090 Microsoft-Windows- Error Manual
configuration
started FailoverClustering
data from the
Windows
registry failed.

Resolve
Action
The Cluster
service failed to
Based on event start because it
Cluster service
1105 Microsoft-Windows- Error Manual was unable to
failed to start
FailoverClustering register
interface(s) with
the RPC service.
Cluster service
could not write
to a file. In a
failover cluster,
most clustered
services or
applications use
at least one disk,
also called a disk
resource, that
Cluster service Based on event
you assign when
failed to write 1080 Microsoft-Windows- Warning Manual
you configure
data to a file FailoverClustering
the clustered
service or
application.
Clients can use
the clustered
service or
application only
when the disk is
functioning
correctly.
Cluster service
Based on event
Cluster service suffered an
fatal error unexpected fatal
FailoverClustering
error.
Cluster service
was halted due
Based on event
Cluster service to incomplete
interruption connectivity
FailoverClustering
with other
cluster nodes.
The Cluster
Based on event service is
Cluster service
1177 Microsoft-Windows- Error Manual shutting down
shut down
FailoverClustering because quorum
was lost.
Based on event Cluster Shared
5120 Microsoft-Windows- Warning Volume is no
FailoverClustering longer available
on this node. All
Cluster Shared
I/O will
Volume is not Automatic
Based on event temporarily be
available
5122 Microsoft-Windows- Resolve queued until a
FailoverClustering path to the
volume is
reestablished.
Cluster Shared Based on event Cluster Shared
Volume is not 5121 Microsoft-Windows- Warning Automatic Volume is no
directly FailoverClustering longer directly

Resolve
Action
accessible accessible from
this cluster
node. I/O access
will be
redirected to the
storage device
Based on event
over the
5122 Microsoft-Windows- Resolve
network
FailoverClustering
through the
node that owns
the volume. This
may result in
degraded
performance.
Cluster IP
Failed to bring Based on event
address resource
cluster 1049 Microsoft-Windows- Error Manual
cannot be
resource online FailoverClustering
brought online.
The restore
request for the
cluster
configuration
Failed to copy
Based on event data failed to
cluster
1581 Microsoft-Windows- Warning Manual make a copy of
configuration
FailoverClustering the existing
data file
cluster
configuration
data file
(ClusDB).
Cluster network
Failed to create name resource
Based on event
cluster failed to create
resource name its associated
FailoverClustering
in domain computer object
in domain.
Based on event
High-Availability
Failed to Based on event Live migration
migrate virtual 22505 Microsoft-Windows-Hyper-V- Error Manual for this VM did
machine High-Availability not succeed.
Based on event
High-Availability
Failed to The failover
Based on event
unload failover cluster database
cluster could not be
FailoverClustering
database unloaded.
The Cluster
service was
Inconsistency Based on event halted to
within the 1073 Microsoft-Windows- Error Manual prevent an
failover cluster FailoverClustering inconsistency
within the
failover cluster.

Resolve
Action
Cluster IP
address resource
Invalid IP Based on event cannot be
address 1047 Microsoft-Windows- Error Manual brought online
detected FailoverClustering because the
address value is
invalid.
Invalid IP Cluster IP
Based on event
address for address resource
cluster failed to come
FailoverClustering
resource online.
Cluster IP
address resource
Based on event cannot be
Invalid subnet
1046 Microsoft-Windows- Error Manual brought online
mask detected
FailoverClustering because the
subnet mask
value is invalid.
The cluster
service
Unexpected Based on event
encountered an
cluster service 1556 Microsoft-Windows- Error Manual
unexpected
problem FailoverClustering
problem and will
be shut down.
Cluster Shared Volume
Resolve
Action
Based on event Cluster Shared

5125 Microsoft-Windows- Volume has
FailoverClustering identified one
or more active
filter drivers on
this device
stack that
could interfere
with CSV
Active filter operations. I/O
drivers Warning Manual access will be
Based on event redirected to
detected
5126 Microsoft-Windows- the storage
FailoverClustering device over the
network
through
another Cluster
node. This may
result in
degraded
performance.
Average read latency for 15 minutes is Cluster Shared
Warning
above 40 milliseconds Volume has
Cluster Shared exceeded the
Volume 2012 Automatic configured
Average read latency for 15 minutes is threshold of
read latency Error
above 80 milliseconds total read
latency.

Resolve
Action
Average write latency for 15 minutes is Cluster Shared

Warning
above 40 milliseconds Volume has
Cluster Shared exceeded the
Volume 2012 Automatic configured
Average write latency for 15 minutes is threshold of
write latency Error
above 80 milliseconds total write
latency.
Free space is below 10% Warning Cluster Shared
Cluster Shared
Volume is low
Volume free Automatic
Free space is below 5% Error on available
space
free space.
Cluster Shared
Volume
redirected
access was
turned on.
Access to the
storage device
Redirected Based on event will be
access was 5136 Microsoft-Windows- Warning Manual redirected over
turned on FailoverClustering the network
from all cluster
nodes that are
accessing this
volume. This
may result in
degraded
performance.
A backup
application
initiated a VSS
snapshot on
Cluster Shared
Volume
without
Volume properly
Based on event
snapshot preparing the
preparation volume for
FailoverClustering
error snapshot. This
snapshot may
be invalid and
the backup
may not be
usable for
restore
operations.

Local Storage
Resolve
Action
Avg Disk sec/Read value for 15 This host local

Warning
minutes is 40 milliseconds disk has
exceeded the
threshold for
total read
latency. This
performance
Datastore read monitor
Automatic
latency Avg Disk sec/Read value for 15 counter
Error measures the
minutes is 80 milliseconds
amount of time
that read
operations take
to respond to
the operating
system.
Avg Disk sec/Write value for 15 This host disk
Warning
minutes is 40 milliseconds has exceeded
the threshold
for total write
latency. This
performance
monitor
Datastore write
Automatic counter
latency Avg Disk sec/Write value for 15
Error measures the
minutes is 80 milliseconds amount of time
that write
operations take
to respond to
the operating
system.
Free space is below 10% Warning Automatic Local volume is
Local volume
low on available
free space Free space is below 5% Error free space.
Any Hyper-V Object
Resolve
Action
The Hyper-V
Virtual Machine
Failed to Management
Based on event
register VM service failed to
configuration register the
VMMS
file configuration
for the virtual
machine.
The Hyper-V
Virtual Machine
Failed to Management
Based on event
unregister VM service failed to
configuration unregister the
VMMS
file configuration
for the virtual
machine.

Resolve
Action
The Hyper-V
Virtual Machine
Management
Failed to verify
Based on event service failed to
VM
20104 Microsoft-Windows-Hyper-V- Warning Manual verify that the
configuration
VMMS configuration is
file
registered for
the virtual
machine.
Failed to revert
to VSS snapshot
Based on event
Failed to revert on one or more
to VSS snapshot virtual hard
VMMS
disks of the
virtual machine.
Based on event
Worker
Based on event
SynthStor
Based on event
VMMS
Based on event
VMMS
Based on event
Failed to open Cannot open
VM attachment VM attachment.
Worker
Based on event
SynthStor
Based on event
VMMS
Based on event
Worker
Based on event
SynthStor
Failed to load Based on event Cannot load a
VM 16300 Microsoft-Windows-Hyper-V- Error Manual virtual machine
configuration VMMS configuration.
Cannot load the
VM Based on event virtual machine
configuration 16310 Microsoft-Windows-Hyper-V- Error Manual because the
file is corrupt VMMS configuration is
corrupt.
Cluster Shared
Volume is no
Cluster Shared
Based on event longer
Volume is no
5142 Microsoft-Windows- Error Manual accessible from
longer
FailoverClustering this cluster
accessible
node because
of error.

Internal Alarms
The following table describes internal Veeam ONE alarms.
Based on event
Error Veeam ONE
VeeamBpPerfCollectionFailedEvent
Backup failed to collect
Based on event
performance Resolve performance
VeeamMonitorServicesStartedEvent
data collection data from the
failure Based on event specified
VeeamBpPerfCollectionFailedResolved Resolve backup server.
Event
Based on event
Error Veeam ONE
VeeamNoHostConnectionEvent
failed to collect
Backup server Based on event
data from a
data collection VeeamNoHostConnectionResolvedEve Resolve
Veeam Backup
problem nt
& Replication
Based on event server.
Resolve
Based on event
Warning Veeam ONE
VeeamDPCacheEvent
failed to write
Based on event
Disk cache error Resolve performance
VeeamDPCacheResolvedEvent
data to the disk
Based on event cache folder.
Resolve
Based on event
Error Veeam ONE
VeeamEventCollectionFailedEvent
failed to collect
Events data Based on event
events data
collection VeeamEventCollectionFailedResolvedE Resolve
from the
failure vent
objects
Based on event specified.
Resolve
Based on event
VeeamHardwareSensorsCollectionEve Error
Hardware nt Veeam ONE
sensors Based on event failed to collect
collection VeeamHardwareSensorsCollectionRes Resolve host hardware
failure olvedEvent information.
Based on event
Resolve
Based on event
Error Veeam ONE
VeeamPerfCollectionFailedEvent
failed to collect
Performance Based on event
performance
data collection VeeamPerfCollectionFailedResolvedEv Resolve
data from the
failure ent
objects
Based on event specified.
Resolve
Based on event Veeam ONE
Warning
VeeamSqlLowDbFreeSpaceEvent database size is
Based on event close to
SQL Server
VeeamSqlLowDbFreeSpaceResolvedEv Resolve maximum
Express
ent database size
database size
supported by
Based on event SQL Server
Resolve
VeeamMonitorServicesStartedEvent Express Edition.

Based on event
Error
VeeamInfCollectionFailedEvent
Veeam ONE
Topology Based on event
failed to collect
collection VeeamInfCollectionFailedResolvedEve Resolve
infrastructure
failure nt
topology.
Based on event
Resolve
Based on event
VeeamVcdBlockingTaskUpdateFailedE Error Veeam ONE
vCloud Director vent failed to update
blocking tasks vCloud Director
Based on event blocking tasks
update failure
VeeamVcdBlockingTaskUpdateFailedR Resolve list.
esolvedEvent
Based on event Veeam ONE
Error
VeeamNoVcdHostConnectionEvent failed to collect
vCloud Director Based on event performance
connection VeeamNoVcdHostConnectionResolved Resolve and
failure Event configuration
Based on event data from
Resolve vCloud Director.
Based on event
VeeamVcdStrandedItemUpdateFailedE Error Veeam ONE
vCloud Director vent failed to update
stranded items vCloud Director
Based on event stranded items
update failure
VeeamVcdStrandedItemUpdateFailed Resolve list.
ResolvedEvent
Based on event
Warning
VeeamLicenseExpirationWarningEvent
Based on event
Error
VeeamLicenseExpirationErrorEvent
Veeam ONE Based on event Veeam ONE
Resolve
license VeeamLicenseChangedEvent license is going
expiration date Based on event to expire soon.
VeeamLicenseExpirationResolvedEven Resolve
t
Based on event
Resolve
Based on event
Error
VeeamSocketExceedEvent The number of
Veeam ONE
Based on event licensed servers
license sockets Resolve
VeeamSocketExceedResolvedEvent has been
exceeded
Based on event exceeded.
Resolve
Based on event License update
Veeam ONE Warning
VeeamLicenseUpdateErrorEvent failure can take
license update
Based on event place for a
failure Resolve
VeeamLicenseUpdateResolvedEvent number of

reasons such as
connection
failure, invalid
identifier,
expired
contract, etc. In
case of a
Based on event
Resolve connection
problem and
licensing server
key generation
error, Veeam
ONE will retry to
update the
license key.
Based on event Your license
Error
VeeamVMsExceedErrorEvent limit has been
Based on event exceeded. You
Warning need to
VeeamVMsExceedWarningEvent
Based on event purchase
Veeam ONE Resolve additional VMs
VeeamVMsExceedResolvedEvent
license VMs licensing before
exceeded all VMs
exceeding the
Based on event licensed
Resolve
VeeamMonitorServicesStartedEvent amount will no
longer be
monitored.
Job state equals Failed. Error Veeam ONE
Veeam ONE
Reporter
Reporter
Job state equals Warning. Warning session task
collection job
failed.
Based on event
VeeamLicenseSupportExpirationWarni Warning
ngEvent
Based on event
VeeamLicenseSupportExpirationErrorE Error
vent Veeam ONE
Veeam ONE
support period
support Based on event
Resolve is going to
expiration date VeeamLicenseChangedEvent
expire soon.
Based on event
VeeamLicenseSupportExpirationResol Resolve
vedEvent
Based on event
Resolve
Based on event
Error
VeeamNoHostConnectionEvent
Virtual Server Based on event Connection to
connection VeeamNoHostConnectionResolvedEve Resolve virtual server
failure nt has failed.
Based on event
Resolve

Appendix B. Alarm Rules
This section describes rules that can be used to create alarms for virtual and backup infrastructures.
Alarm Rules for VMware vSphere

Veeam ONE offers the following types of alarm rules for VMware vSphere infrastructure objects:
vCenter Server
Cluster
Host
Virtual Machine
Datastore
Any Object
Resource Pool
vCenter Server
Rule Type Description
Event-based rule An alarm is triggered if some vCenter-related event is generated.
Existing alarm An alarm is triggered if the state of another selected alarm is changed.
An alarm is triggered if the vCenter Server state reports to be equal or not

Power or connection state
equal to a specific state value (for example, if vCenter Server is not
changes
responding).
Cluster
Event-based rule An alarm is triggered if some cluster-related event is generated.
Resource usage is out of An alarm is triggered if the specified counter is above or below the specified
allowed range threshold value (for example, if the memory usage exceeds 80%).

Host
Event-based rule An alarm is triggered if some host-related event is generated.
Hardware sensor state An alarm is triggered if the sensor state reports to be equal or not equal to a
changes specific state value (Normal, Warning, Alert, Unknown).
An alarm is triggered if the number of running, powered off or suspended VMs

Number of VMs is out of on the ESX(i) host exceeds the specified threshold value. This type of alarm can
allowed range be configured if it is necessary to limit the number of VMs running on the
ESX(i) host at the same time to avoid the host overload.
Power or connection state An alarm is triggered if the host state reports to be equal or not equal to a
changes specific state value (for example, if the ESX(i) host is not responding).
allowed range threshold value (for example, if the CPU usage exceeds 75%).
Virtual Machine
An alarm is triggered if some VM-related event is generated (for example, if the

Event-based rule MAC address of the VM conflicts with the MAC address of another VM existing
in the virtual infrastructure).
Orphaned Veeam Backup & An alarm is triggered if a VM has a snapshot that Veeam Backup & Replication
Replication snapshot has created (to back up, replicate or perform another data protection operation for
been detected the VM) but was unable to remove when the operation was over.
An alarm is triggered if a monitored virtual machine is not available or

Heartbeat is missing overloaded for a specific period of time (for example, if heartbeat is missing for
5 minutes).
Power or connection state An alarm is triggered if the state of the VM reports to be equal or not equal to
changes the specified state value (for example, if the VM is suspended).
allowed range value (for example, if the CPU ready level exceeds 5%).
An alarm is triggered if available disk space on guest volumes is below the

Guest volumes are running specified threshold value. You can choose to specify the amount of due free
out of free disk space space as an absolute value (for example, if free disk space falls below 1 GB) or a
relative value (for example, if free disk space falls below 10% of total space).
Snapshot age for VM has An alarm is triggered if the current snapshot is older than a specified number
exceeded the configured of hours. This rule helps monitor forgotten snapshots that are consuming
threshold valuable storage space and degrading performance of virtual machines.
VM snapshots number has

An alarm is triggered if the number of snapshots created for the VM is greater
exceeded the configured
than the specified threshold.
threshold

An alarm is triggered if the size of the VM snapshot is above or below the

specified threshold value. You can choose to specify the size of the snapshot as
Snapshot size for VM is out of
an absolute value (for example, if the snapshot size exceeds 5 GB) or a relative
allowed range
value (for example, if the snapshot size exceeds 10% of total available disk
space).
An alarm is triggered if the state of the VMware Tools reports to be equal or

not equal to the specified state value (for example, if the VMware Tools is out
changes
of date).
An alarm is triggered if the age of the latest backup or replica restore point for
VMs with no restore points the VM has exceeded the threshold (that is, if there are no restore points for
the specified RPO period).
Datastore
Event-based rule An alarm is triggered if some datastore-related event is generated.
An alarm is triggered if free space on the datastore is above or below the

specified threshold value. You can choose to specify the free space threshold
Datastore is running out of
as an absolute value (for example, if the datastore space should not fall below
free space
10 GB) or a relative value (for example, if the datastore free space should not
fall below 15% of total space).
An alarm is triggered if the provisioned disk space is above or below the

specified threshold value. You can select to specify the threshold as an
Datastore provisioned space absolute value (for example, if the provisioned disk space should not exceed
500 GB) or a relative value (for example, if the provisioned disk space should
not exceed 400% compared to the datastore capacity).
An alarm is triggered if the speed of datastore operations is above or below

Datastore speed
the specified threshold value.
An alarm is triggered if the state of the datastore reports to be equal or not

Power or connection state
equal to the specified state value (for example, if the datastore is not
changes
accessible).
allowed range threshold value (for example, if the datastore I\O threshold is violated).
Any Object
An alarm is triggered if some event is generated on any object in the

Event-based rule
infrastructure.

Event-based rule An alarm is triggered if some vApp-related event in generated.
allowed range value (for example, if the storage usage exceeds 80%).
vCloud Director object task An alarm is triggered if the vApp state reports to be equal or not equal to a
status specific state value (for example, if warnings are registered for the vApp).
System health status change An alarm is triggered if the object health state changes.
vApp runtime lease timeout An alarm is triggered in N days after the vApp runtime lease has expired.
vApp storage lease timeout An alarm is triggered in N days after the vApp storage lease has expired.

Event-based rule An alarm is triggered if some event is generated on the organization.
Organization VCD blocking An alarm is triggered if the number of pending blocking tasks has exceeded
task number the specified threshold.
Organization VCD blocking

An alarm is triggered in N minutes after the blocking tasks has expired.
task timeout
An alarm is triggered if the organization state reports to be equal or not equal

vCloud Director object task
to a specific state value (for example, if warnings are registered for the
status
organization).
System health state change An alarm is triggered if the object health state changes.

Event-based rule An alarm is triggered if some event is generated on the organization VCD.
allowed range value (for example, if the CPU ready level exceeds 5%).
An alarm is triggered if the organization VCD state reports to be equal or not

equal to a specific state value (for example, if warnings are registered for the
status
organization VCD).

An alarm is triggered if the number of remaining IP addresses is above or

below the specified threshold value. You can select to specify the threshold as
Network pool is running out an absolute value (for example, if the number of remaining IP addresses
of available IP addresses should not be lower than 5) or a relative value ( if the number of remaining IP
addresses should not be lower than 10% of the total number for the
organization VCD network).

Event-based rule An alarm is triggered if some event is generated on the provider VCD.
allowed range value (for example, if the storage usage exceeds 80%).
An alarm is triggered if the provider VCD state reports to be equal or not equal
to a specific state value (for example, if warnings are registered for the
status
provider VCD).
Resource Pool
Event-based rule An alarm is triggered if some event is generated on a resource pool.
allowed range value (for example, if the CPU usage exceeds 80%).

Alarm Rules for Microsoft Hyper-V
Veeam ONE offers the following types of alarm rules for Microsoft Hyper-V infrastructure objects:
Host
Virtual Machine
Cluster
CSV
Local Storage
Any Object
Host
Event-based rule An alarm is triggered if some host-related event is generated.
An alarm is triggered if the state of another selected alarm is

Existing alarm
changed.
An alarm is triggered if the state of the specified service reports to

Windows Server service state be equal or not equal to a specific state value for a specified time
(for example, if a service is paused for 10 minutes).
An alarm is triggered if the host state reports to be equal or not

Power or connection state changes equal to a specific state value (for example, if the Hyper-V host is
not responding).
An alarm is triggered if the specified counter is above or below the

Resource usage is out of allowed range specified threshold value (for example, if the Total Run Time
exceeds 75%).
Virtual Machine
An alarm is triggered if some VM-related event is generated (for

Event-based rule example, if the MAC address of the VM conflicts with the MAC
address of another VM existing in the virtual infrastructure).
An alarm is triggered if available disk space on guest volumes is

below the specified threshold value. You can choose to specify the
Guest volumes are running out of free
amount of due free space as an absolute value (for example, if free
disk space
disk space falls below 1 GB) or a relative value (for example, if free
disk space falls below 10% of total space).
An alarm is triggered if the current checkpoint is older than a

Checkpoint age for Hyper-V VM has specified number of hours. This rule helps monitor forgotten
exceeded the configured threshold checkpoints that are consuming valuable storage space and
degrading performance of virtual machines.
An alarm is triggered if the size of the VM checkpoint is above or

Checkpoint size for Hyper-V VM is out of
size of the checkpoint as an absolute value (for example, if the
allowed range
checkpoint size exceeds 5 GB) or a relative value (for example, if
the checkpoint size exceeds 10% of total available disk space).


Existing alarm
changed.

Resource usage is out of allowed range specified threshold value (for example, if the Guest Run Time level
exceeds 5%).
An alarm is triggered if the age of the latest backup or replica

VMs with no restore points restore point for the VM has exceeded the threshold (that is, if
there are no restore points for the specified RPO period).
Cluster
An alarm will be triggered if some cluster-related event is

Event-based rule
generated.

Existing alarm
changed.
Cluster Shared Volumes (CSV)

An alarm is triggered if some event occurs on Cluster Shared

Event-based rule
Volumes level.
An alarm is triggered if free space on the CSV is above or below the

specified threshold value. You can choose to specify the free space
CSV is running out of free space threshold as an absolute value (for example, if the CSV space
should not fall below 10 GB) or a relative value (for example, if the
CSV free space should not fall below 15% of total space).

Existing alarm
changed.

Resource usage is out of allowed range
specified threshold value.
Local Storage
Event-based rule An alarm is triggered if some storage-related event is generated.
An alarm is triggered if free space on the datastore is above or

Hyper-V datastore is running out of free free space threshold as an absolute value (for example, if the
space datastore space should not fall below 10 GB) or a relative value (for
example, if the datastore free space should not fall below 15% of
total space).

Existing alarm
changed.

An alarm will be triggered if the specified counter is above or

Resource usage is out of allowed range below the specified threshold value (for example, the average disk
queue length exceed the threshold).
Any Object
Event-based rule An alarm is triggered if some event is generated on any object.
An alarm is triggered if the status of another alarm specified in the

Existing alarm
settings is changed.
An alarm is triggered if the state of the specified service reports to

Windows Server service state be equal or not equal to a specific state value for a specified time
(for example, if a service is paused for 10 minutes).

Alarm Rules for Veeam Backup & Replication
Veeam ONE offers the following types of alarm rules for Veeam Backup & Replication infrastructure
objects:
Enterprise Manager
Backup Server
Repository
Proxy
WAN Accelerator
Tape Server
Cloud Repository
Cloud Gateway
Enterprise Manager
An alarm is triggered if some Veeam Backup & Replication event is

Event-based rule
generated for the Veeam Backup Enterprise Manager.

Existing alarm
changed.
An alarm is triggered if the state of Veeam Backup Enterprise

Power or connection state changes Manager is equal or not equal to the specified value (for example, if
connection to the Enterprise Manager is lost).
Backup Server

Event-based rule
generated for the backup server.
An alarm is triggered if the time during which a job was disabled

Disabled job
has exceeded the specified.
Job duration exceeded the allowed An alarm is triggered if duration of a backup or replication job has
time period exceeded a threshold duration value (specified in minutes).

Existing alarm
changed.
An alarm is triggered if the state of Veeam Backup server is equal or

Power or connection state changes not equal to the specified value (for example, if connection to the
backup server is lost).

Repository

Event-based rule
generated for the repository.
An alarm is triggered if Veeam Backup & Replication software

Out-of-date state
components installed on the repository server are out of date.

Existing alarm
changed.
An alarm is triggered if free space on the repository is above or

below the specified threshold value. You can select to specify the
Repository server is running out of free
free space threshold as an absolute value (for example, if the
space
storage space should not fall below 10 GB) or a relative value (for
example, if the free space should not fall below 15% of total space).
An alarm is triggered if the state of the backup repository is equal or

repository is lost).
Proxy

Event-based rule
generated for the backup proxy.

Out-of-date state
components installed on the proxy server are out of date.

Existing alarm
changed.
An alarm is triggered if the state of backup proxy is equal or not

Power or connection state changes equal to the specified value (for example, if connection to the proxy
server is lost).
WAN Accelerator

Event-based rule
generated for the WAN accelerator.

Out-of-date state components installed on the WAN accelerator server are out of
date.

Existing alarm
changed.
An alarm is triggered if the state of the WAN accelerator is equal or

WAN accelerator is lost).

Tape Server

Event-based rule
generated for the tape server.

Out-of-date state
components installed on the tape server are out of date.

Existing alarm
changed.
An alarm is triggered if the state of the backup repository is equal or

server is lost).
Cloud Repository

Event-based rule
generated for the cloud repository.
An alarm is triggered if cloud repository lease time will expire in the

Cloud repository lease expiration
specified number of days.
An alarm is triggered if the number of VMs stored in the backup

Number of VMs stored in repository
repository has exceeded the specified threshold.

Existing alarm
changed.
An alarm is triggered if free space on the repository is above or

below the specified threshold value. You can select to specify the
Repository server is running out of free
free space threshold as an absolute value (for example, if the
space
storage space should not fall below 10 GB) or a relative value (for
example, if the free space should not fall below 15% of total space).
Cloud Gateway

Event-based rule
generated for the cloud gateway.

Out-of-date state
components installed on the cloud gateway server are out of date.

Existing alarm
changed.
An alarm is triggered if the state of the backup repository is equal

Power or connection state changes or not equal to the specified value (for example, if connection to
the cloud gateway is lost).

Veeam One 9 5 Alarms Guide PDF

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Veeam One 9 5 Alarms Guide PDF

Enviado por

Direitos autorais:

Formatos disponíveis

Veeam ONE

Working with Alarms

2 | Veeam ONE | Working with Alarms | REV 4

3 | Veeam ONE | Working with Alarms | REV 4

4 | Veeam ONE | Working with Alarms | REV 4

5 | Veeam ONE | Working with Alarms | REV 4

Document Revision History

Document updated for Veeam ONE 9.5 Update 1.

Revision 4 3/14/2017 Updated Step 1 in section SNMP Traps.

6 | Veeam ONE | Working with Alarms | REV 4

7 | Veeam ONE | Working with Alarms | REV 4

8 | Veeam ONE | Working with Alarms | REV 4

9 | Veeam ONE | Working with Alarms | REV 4

10 | Veeam ONE | Working with Alarms | REV 4

11 | Veeam ONE | Working with Alarms | REV 4

12 | Veeam ONE | Working with Alarms | REV 4

13 | Veeam ONE | Working with Alarms | REV 4

14 | Veeam ONE | Working with Alarms | REV 4

15 | Veeam ONE | Working with Alarms | REV 4

Step 1. Select Alarm Type

Creating Alarms from Tasks or Events

Creating Alarms from Performance Chart Counters

16 | Veeam ONE | Working with Alarms | REV 4

17 | Veeam ONE | Working with Alarms | REV 4

Adding State-Based Rules

6. Specify alarm severity.

18 | Veeam ONE | Working with Alarms | REV 4

20 | Veeam ONE | Working with Alarms | REV 4

21 | Veeam ONE | Working with Alarms | REV 4

22 | Veeam ONE | Working with Alarms | REV 4

23 | Veeam ONE | Working with Alarms | REV 4

24 | Veeam ONE | Working with Alarms | REV 4

Adding Objects to Alarm Assignment Scope

25 | Veeam ONE | Working with Alarms | REV 4

26 | Veeam ONE | Working with Alarms | REV 4

27 | Veeam ONE | Working with Alarms | REV 4

To define alarm response actions:

28 | Veeam ONE | Working with Alarms | REV 4

Suppressing Alarm During Events

30 | Veeam ONE | Working with Alarms | REV 4

31 | Veeam ONE | Working with Alarms | REV 4

Step 8. Save Alarm Settings

32 | Veeam ONE | Working with Alarms | REV 4

Other Ways to Modify Alarms

Modifying Multiple Alarms

33 | Veeam ONE | Working with Alarms | REV 4

34 | Veeam ONE | Working with Alarms | REV 4

To create a new rule from a performance counter:

35 | Veeam ONE | Working with Alarms | REV 4

36 | Veeam ONE | Working with Alarms | REV 4

37 | Veeam ONE | Working with Alarms | REV 4

38 | Veeam ONE | Working with Alarms | REV 4

39 | Veeam ONE | Working with Alarms | REV 4

40 | Veeam ONE | Working with Alarms | REV 4

41 | Veeam ONE | Working with Alarms | REV 4

42 | Veeam ONE | Working with Alarms | REV 4

43 | Veeam ONE | Working with Alarms | REV 4

44 | Veeam ONE | Working with Alarms | REV 4

What You Can Do Next

45 | Veeam ONE | Working with Alarms | REV 4

46 | Veeam ONE | Working with Alarms | REV 4

47 | Veeam ONE | Working with Alarms | REV 4

48 | Veeam ONE | Working with Alarms | REV 4