Custom Alarms creation to track Datastore File downloads from vCenter server

Products

• VMware vSphere ESXi
• VMware vCenter Server 7.0
• VMware vCenter Server 8.0

Issue/Introduction

This article helps in creating custom alarms when users download files from the datastore, and administrator would like to track these downloads with the user details. 

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x
• VMware vSphere ESXi 7.x
• VMware vSphere ESXi 8.x

Resolution

Step 1: Create an alarm 

• Navigate to vCenter object -> configure -> Alarm definition -> Add 
• On alarm add window provide -> Alarm name -> description (optional) -Target type: Host; Click next. 
• On the If condition type "DatastoreFileDownloadEvent" enter twice and the condition will be added. 
• Arguments if needed
• Provide then condition and notifications. 
  • Please note: If warning or error is defined, consecutive alarms might be missed out. Please use "keep the target's current state" if the intend is to track it using snmp or email. 

• Go next and complete finish the alarm definition. 
• Trigger a file download to test email notification or alarm banner on the vCenter if (warning or error specified). 

Step 2: defining the alarm on vpx extensions to list on the vCenter events tab: 

• cd to /etc/vmware-vpx/extensions/VirtualCenter 
• Take a backup of the extension.xml file 
  • cp extension.xml extension.xml_backup
• Use vim editor to edit the extension.xml file.
• Search for </event>
• Once found insert the is following content: 

<event id="DatastoreFileDownloadEvent">
<EventType>
<eventTypeID>DatastoreFileDownloadEvent</eventTypeID>
<description>Datastore file download</description>
<arguments>
<argument>
<name>sourceOfOperation</name>
<type>string</type>
</argument>
<argument>
<name>targetPath</name>
<type>string</type>
</argument>
<argument>
<name>succeeded</name>
<type>boolean</type>
</argument>
</arguments>
</EventType>
</event>
<event id="DatastoreFileUploadEvent">
<EventType>
<eventTypeID>DatastoreFileUploadEvent</eventTypeID>
<description>Datastore file upload</description>
<arguments>
<argument>
<name>sourceOfOperation</name>
<type>string</type>
</argument>
<argument>
<name>targetPath</name>
<type>string</type>
</argument>
<argument>
<name>succeeded</name>
<type>boolean</type>
</argument>
</arguments>
</EventType>
</event>

         <!-- Please ensure that all new events are added above this comment
              (to avoid accidentally adding them outside the closing events tag)
         -->

• Save the file and exit. 

Step 3: Add the username options to display and understand who downloaded the file

• cd to /etc/vmware-vpx/locale/en
• Take a back up of the event.vmsg 
  • cp extension.xml extension.xml_backup
• Using vim or vi editor edit the file. 
  • Search for the DatastoreFileDownloadEvent here and the section below this will look like the following: 

DatastoreFileDownloadEvent.category                                 = "info"
DatastoreFileDownloadEvent.description                              = "File downloaded to datastore"
DatastoreFileDownloadEvent.formatOnComputeResource                  = ""
DatastoreFileDownloadEvent.formatOnDatacenter                       = "File download from path '{targetPath}' was initiated from '{sourceOfOperation}' and completed with status '{[email protected]}'"
DatastoreFileDownloadEvent.formatOnHost                             = ""
DatastoreFileDownloadEvent.formatOnVm                               = ""
DatastoreFileDownloadEvent.fullFormat                               = "File download from path '{targetPath}' was initiated from '{sourceOfOperation}' and completed with status '{[email protected]}' 

• • Edit the last line, and add user name = {userName}" as shown below:

DatastoreFileDownloadEvent.category                                 = "info"
DatastoreFileDownloadEvent.description                              = "File downloaded to datastore"
DatastoreFileDownloadEvent.formatOnComputeResource                  = ""
DatastoreFileDownloadEvent.formatOnDatacenter                       = "File download from path '{targetPath}' was initiated from '{sourceOfOperation}' and completed with status '{[email protected]}'"
DatastoreFileDownloadEvent.formatOnHost                             = ""
DatastoreFileDownloadEvent.formatOnVm                               = ""
DatastoreFileDownloadEvent.fullFormat                               = "File download from path '{targetPath}' was initiated from '{sourceOfOperation}' and completed with status '{[email protected]}' user name = {userName}"

• • Save the file and exit. 

Step 4: Restart the vSphere UI and vpxd service. 

• service-control --stop vpxd vsphere-ui
• service-control --start vpxd vsphere-ui