Monitoring vCenter 6.7 Scheduled Backups with Log Insight

One of the great features within VCSA 6.7 is the ability to schedule daily backups. The only challenge is that there is no built-in notifications as to whether they succeeded or not.  At times I’ve gone a few days (weeks) until I noticed they weren’t successful so I decided to monitor the jobs with Log Insight.

 

VMware Versions:

• VCSA 6.7 build 9433931
• Log Insight 4.6.0 build 8080673

Prerequisites:

• Add Log Insight as a Syslog Host within VCSA VAMI
• Configure VCSA Scheduled Backups

 

Search for Backup Job Statuses:

Within Log Insight go to Interactive Analytics.

To see all backup job info use the following criteria:

• Search string = “INFO Backup job“
• Date/time range = Make sure you “All Time” for the date/time range

Click the search icon or hit enter. You will see scheduled backup events for status types of started, finished successfully, canceled successfully, and failed to start.

If you want to get alerts for all statuses then use the search criteria listed above. Or you can pick individual statuses to alert on.

 

In my case a backup job would run forever so I only want to know when jobs are successful. If I don’t receive an email in the morning then I know something is wrong. For this I’ll use “INFO Backup job finished successfully” for my search criteria and the same time range.

Setup Job Alerts:

Now that you have your search criteria, click on the red bell to the right of the date/time range area and select Create Alert from Query…

Finish new alert setup:

1. Give your alert a descriptive name as this will be the Subject line of the email and in case you need to change it later.
2. Optionally you can add a Description and/or Recommendation that will be within the body of the email.
3. Add email addresses to the notify area.  you can also send to vROM if you wish.
4. Within Raise an alert I use “on any match” in case the job runs long or is manually triggered before patching/upgrades.
5. Click SAVE.

 

Within a few minutes you will receive an email for the jobs that ran within your search criteria and anytime from that point on.

NOTE:  The query only runs once per hour.  If you have multiple VCSA/PSC and they finish within the same hour since the last query you will only get 1 email with an entry for each VCSA/PSC.

Modify Alerts:

If you need to modify the alert later, click the red bell again and select Manage Alerts. Locate your alert and click the pencil icon to modify it.