5.1

4 Click Endpoint.
The vShield Endpoint Health and Alarms page displays the health of the objects under the datacenter,
cluster, or ESX host you selected, and the active alarms. Health status changes are reflected within a minute
of the actual occurrence of the event that triggered the change.
vShield Endpoint Alarms
Alarms signal the vCenter Server administrator about vShield Endpoint events that require attention. Alarms
are automatically cancelled in case the alarm state is no longer present.
vCenter Server alarms can be displayed without a custom vSphere plug-in. See the vCenter Server Administration
Guide on events and alarms.
Upon registering as a vCenter Server extension, the vShield Manager defines the rules that create and remove
alarms, based on events coming from the three vShield Endpoint components: SVM, vShield Endpoint module,
and thin agent. Rules can be customized. For instructions on how to create new custom rules for alarms, see
the vCenter Server documentation. In some cases, there are multiple possible causes for the alarm. The tables
that follow list the possible causes and the corresponding actions you might want to take for remediation.
Host Alarms
Host alarms are generated by events affecting the health status of the vShield Endpoint module.
Table 14-1. Errors (Marked Red)
Possible Cause Action
The vShield Endpoint module has been installed
on the host, but is no longer reporting status to the
vShield Manager.
1 Ensure that vShield Endpoint is running by logging in to the host
and typing the command /etc/init.d/vShield-Endpoint-Mux
start
2 Ensure that the network is configured properly so that vShield
Endpoint can connect to the vShield Manager.
3 Reboot the vShield Manager.
SVM Alarms
SVM alarms are generated by events affecting the health status of the SVM.
Table 14-2. Red SVM Alarms
Problem Action
There is a protocol version mismatch with the
vShield Endpoint module
Ensure that the vShield Endpoint module and SVM have a protocol
that is compatible with each other.
vShield Endpoint could not establish a connection
to the SVM
Ensure that the SVM is powered on and that the network is configured
properly.
The SVM is not reporting its status even though
guests are connected.
Internal error. Contact your VMware support representative.
vShield Endpoint Events
Events are used for logging and auditing conditions inside the vShield Endpoint-based security system.
Events can be displayed without a custom vSphere plug-in. See the vCenter Server Administration Guide on
events and alarms.
Events are the basis for alarms that are generated. Upon registering as a vCenter Server extension, the vShield
Manager defines the rules that create and remove alarms.
Common arguments for all events are the event time stamp and the vShield Manager event_id.
vShield Administration Guide
174 VMware, Inc.