VMs reboot all the time and while most often you won't care, there are times you want to be notified. How can we use VMware Aria Operations (formerly vRealize Operations or vROps) to capture VM reboots?
There are two VM metrics to consider:
OS Uptime: Seconds the OS has been up and running.
Uptime: Seconds since system startup, ie seconds the virtual hardware has been powered on. VMware Senior Staff Technical Marketing Manager Brandon Gordon explained it best: VM Uptime would consider sitting at the BIOS screen as up, but not the OS as up.
Based on these definitions, let's use OS Uptime to determine if a VM was recently rebooted. We'll define an Alert based on OS Uptime being less than five minutes, indicating the VM was rebooted within the last five minutes.
You can enable this Alert for all VMs in your environment by activating it in the Default Policy, but I'd like to enable it on just my VMs. What to do:
Create a Custom Group with just the VMs you want
Create a Policy inherited from the Default Policy
Activate the VM Rebooted Alert in your new Policy and assign the Custom Group
In the end, your new Policy will look like this.
Finally, you can make Notifications on your Alert in the final step of the Alert definition.
I've configured my Alert to email me, let's test it. I logged into vCenter, found the VM I wanted to reboot, then went to ACTIONS - Power - Restart Guest OS. I got the Alert and the email!
Another way to capture VM reboots is via Aria Operations for Logs (formerly vRealize Log Insight or vRLI). Assuming you've configured your vCenters and ESXi Hosts to send logs to Aria Operations for Logs, we'll see the reboot. It'll look something like this.
We can generate an Alert against this query like this.
I've configured mine to send a Slack message and forward an alert to Aria Operations.
So much you can do in Aria Operations and Aria Operations for Logs, check them out!