Kaseya Community

What is the most efficient way to Microsoft Hyper-V event logs for errors?

This question is not answered

Hi all.

Thanks to users on this site, I have a brilliant perfmon and services monitor set for Microsoft Hyper-V, but I'm looking to develop the event log set and monitoring.

I wondered if any of you are using inclusion lists for Hyper-V, and if so, whether or not you are monitoring for specific source wildcards? Also I am unsure which of the twelve billion event logs for Hyper-V (under WIndows 2008 etc) to monitor.

At current count, I am showing 27 Hyper-V event logs, such as Microsoft-Windows-Hyper-V-VMMS-Admin and Microsoft-Windows-Hyper-V-VMMS-Analytic. Are you guys monitoring all of them? Do you find that there's any crosssover or that the logs fall under (for example) "Application" log as well?

My exposure and access to Hyper-V servers is very limited at present, but we will be doing more monitoring on this in the future, so the more proactive configuration I can prepare, the better.

Thanks all.

Phil.

All Replies
  • Hey could u share the Monitor sets for HYper-V.

    We have some ongoing issues  like auto reboot on HYper-v..I wanna monitor them...

    Thanks in Advance

  • Microsoft Hyper-V Monitor Set (Management)

    <?xml version="1.0" encoding="UTF-16" ?>

    <monitor_set_definition version="1.0">

    <MonitorSet name="Microsoft Hyper-V Monitor Set (Best Practice)" description='Microsoft Recommended Hyper-V Monitoring Set' enableCounterMatching='0'>

    <Counters>

    <Counter name='Hyper-V Virtual Machine Health Summary'  description='null' counterObject='Hyper-V Virtual Machine Health Summary'  counter='Health Critical'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='0' thresholdDuration='300' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='Hyper-V Virtual Machine Health Summary'  description='null' counterObject='Hyper-V Virtual Machine Health Summary'  counter='Health Ok'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Under'  thresholdAmount='4' thresholdDuration='300' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='Hyper-V Hypervisor Logical Processor Guest Run Time Total'  description='null' counterObject='Hyper-V Hypervisor Logical Processor'  counter='% Guest Run Time'  counterInstance='_Total'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='80' thresholdDuration='180' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='Hyper-V Hypervisor Logical Processor % HyperVisor Run Time Total'  description='null' counterObject='Hyper-V Hypervisor Logical Processor'  counter='% Hypervisor Run Time'  counterInstance='_Total'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='50' thresholdDuration='1200' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='Hyper-V Hypervisor Logical Processor % Total Run Time'  description='null' counterObject='Hyper-V Hypervisor Logical Processor'  counter='% Total Run Time'  counterInstance='_Total'  counterSampleInterval='60' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='85' thresholdDuration='300' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='PhysicalDisk Current Queue Length Total'  description='Current Disk Queue Length Total (Should be around 2 per Drive Max)' counterObject='PhysicalDisk'  counter='Current Disk Queue Length'  counterInstance='_Total'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='12' thresholdDuration='300' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='PhysicalDisk Bytes / Second'  description='Disk Bytes / Second Total' counterObject='PhysicalDisk'  counter='Disk Bytes/sec'  counterInstance='_Total'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Over'  thresholdAmount='40000000' thresholdDuration='900' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='Memory Pages / Second'  description='Pages per Second' counterObject='Memory'  counter='Pages/sec'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Under'  thresholdAmount='-1' thresholdDuration='900' thresholdWarning='10' thresholdReArm='3600'/>

    <Counter name='Memory Available MBytes'  description='Memory Available MBytes' counterObject='Memory'  counter='Available MBytes'  counterSampleInterval='300' collectionOperator='Over'  collectionThreshold='-1' trendTimeSpan='1209600' trendReArm='3600' thresholdOperator='Under'  thresholdAmount='500' thresholdDuration='3600' thresholdWarning='10' thresholdReArm='86400'/>

    </Counters>

    <Services>

    <Service name='vmms'  serviceDescription='Hyper-V Virtual Machine Management' description='Management Service for Hyper-V' restartAttempts='3' restartInterval='60' reArm='3600'/>

    <Service name='vhdsvc'  serviceDescription='Hyper-V Image Management Service' description='Hyper-V Image Management Service' restartAttempts='3' restartInterval='60' reArm='3600'/>

    <Service name='nvspwmi'  serviceDescription='Hyper-V Networking Management Service' description='Hyper-V Networking Management Service' restartAttempts='3' restartInterval='60' reArm='3600'/>

    </Services>

    <Processes>

    </Processes>

    </MonitorSet>

    </monitor_set_definition>

  • Microsoft Hyper-V Client Tools Service Monitor Set

    <?xml version="1.0" encoding="UTF-16" ?>

    <monitor_set_definition version="1.0">

    <MonitorSet name="Microsoft Hyper-V Client Tools Services" description='Hyper V Client Tools Services' enableCounterMatching='1'>

    <Counters>

    </Counters>

    <Services>

    <Service name='vmickvpexchange'  serviceDescription='Hyper-V Data Exchange Service' description='Hyper-V Data Exchange Service' restartAttempts='3' restartInterval='180' reArm='43200'/>

    <Service name='vmicshutdown'  serviceDescription='Hyper-V Guest Shutdown Service' description='Hyper-V Guest Shutdown Service' restartAttempts='3' restartInterval='180' reArm='43200'/>

    <Service name='vmicheartbeat'  serviceDescription='Hyper-V Heartbeat Service' description='Hyper-V Heartbeat Service' restartAttempts='3' restartInterval='180' reArm='43200'/>

    <Service name='vmictimesync'  serviceDescription='Hyper-V Time Synchronization Service' description='Hyper-V Time Synchronization Service' restartAttempts='3' restartInterval='180' reArm='43200'/>

    <Service name='vmicvss'  serviceDescription='Hyper-V Volume Shadow Copy Requestor' description='Hyper-V Volume Shadow Copy Requestor' restartAttempts='3' restartInterval='180' reArm='43200'/>

    </Services>

    <Processes>

    </Processes>

    </MonitorSet>

    </monitor_set_definition>

  • (Many thanks to whomever originally contributed those sets. They are not my original IP)