VMware VSHIELD APP 1.0 -, Руководство администратора

Страница: 82 / 146

vShield Administration Guide
82 VMware, Inc.
Alarms
Alarms signal the vCenter Server administrator about vShield Endpoint events that require attention. Alarms
are automatically cancelled in case the alarm state is no longer present.
vCenter Server alarms can be displayed without a custom vSphere plug ‐ in. See the vCenter Server
Administration Guide on events and alarms.
Upon registering as a vCenter Server extension, the vShield Manager defines the rules that create and remove
alarms, based on events coming from the three vShield Endpoint components: SVM, vShield Endpoint
module, and thin agent. Rules can be customized. For instructions on how to customize rules for alarms, see
the vCenter Server documentation. In some cases, there are multiple possible causes for the alarm. The tables
that follow list the possible causes and the corresponding actions you might want to take for remediation.
vShield Endpoint defines three sets of alarms:

“Host Alarms” on page 82

“SVM Alarms” on page 82

“VM Alarms” on page 83
Host Alarms
Host alarms are generated by events affecting the health status of the vShield Endpoint module.
SVM Alarms
SVM alarms are generated by events affecting the health status of the vShield Endpoint module.
Table 14-1. Warnings (Marked Yellow)
Possible Cause Action
SVM is registered, but vShield Endpoint
module does not see any virtual machines to
protect. No requests for protection are coming
from any virtual machines. No virtual machines
are currently protected.

Usually a transient state occurring while existing virtual
machines are being moved with vMotion, or are just coming up.
No action required.

The ESX host has no virtual machines yet, or only virtual
machines with non ‐ supported operating systems. No action
required.

Check the vShield Manager console for the status of the virtual
machines that should be protected on that host. If one or more
have an error status, the Endpoint thin agents in those machines
may be malfunctioning.
Table 14-2. Errors (Marked Red)
Possible Cause Action
The SVM version is not compatible with the
vShield Endpoint module version.
Install compatible components. Look in the vShield Endpoint
Installation Guide for compatible versions for vShield Endpoint
module and SVM.
Table 14-3. Red SVM Alarms
Problem Action
The vShield Monitor is not receiving status from
the SVM.
Either there are network issues between the vShield Monitor and the
SVM, or the SVM is not operating properly.
The SVM failed to initialize Contact your security provider for help with SVM errors.