WBEM Polling is working, but No Events/alerts are being created/emailed on monitored VM Host

[Andrew_Haak]

That's strange,

one would think a firewall would stop incomming traffic not outgoing traffic.

[LGentile]

I'm actually having this same issue.  I am surprised more people haven't mentioned it.

It appears port 5989 is blocked for outgoing CIM requests over WBEM.  The firewall guide says it should be open by default when the CIM server is enabled, however looking at the vSphere client, I can see that there is no outgoing port enabled.

Unfortunately, I can't find any documentation on how to change the rule for this service to allow outgoing connections.  All I have found is how to limit hosts from connecting to it, but I need the WBEM indications to go outward.  The only way I have been able to get this to work is to disable the firewall completely, but that's not really something I want to do.

This didn't happen with 4.1 and I've read it's fixed in 5.5.  I can't understand why a patch hasn't fixed this behavior.  The CIM service is supposed to open the port temporarily to send out indications, according to this troubleshooting document:

http://pubs.vmware.com/vsphere-51/index.jsp#com.vmware.cimsdk.smashpg.doc/04_CIM_SMASH_PG_Troubleshooting.6.3.html

Anyhow..  still researching.  I've had to use vCenter alarms to work around this, which is really annoying when you have a lot of hosts since it's very difficult to configure alarms for only a subset of your environment (we have 4.x and 5.0 in addition to 5.1 and it's only the 5.1s that don't work correctly).

[Andrew_Haak]

Hello there,

One solution if you have G8 or G9 servers, you can enable SNMP traps on the ILO for hardware events.(Agentless monitoring)

As far as i know wbem traps use dynamic traps so the default WBEM 5989 port would not be enough.

[LGentile]

Yeah, agentless has been something I have wanted to do for a while, but we have so many Gen8 machines deployed, the work involved to get them configured for agentless is somewhat large.  Granted, I have been working with PowerShell and the new scripting cmdlets to make this easier, but it is still a big task.

I had SNMP forwarded for a while, but sometimes you get strange results (IP addresses or serial #s instead of host names, etc) so i need to test this further and ensure the settings are correct on the iLOs to support agentless properly).  I think have the issue was that passthrough was set on most of them so the traps were not as i expected them to be.

Thanks

[sundargit]

Hi, I have configured nearly thousand servers HPSIM configuration and also Test (Generic Trap) alert successful. but Many servers having hardware failures but not getting these events in HPSIM console (CMS). How to pull hardware events into HPSIM manually. i tried hardware status pulling option in hpsim console but no luck. This is my major issue, please help to resolve this

[LGentile]

I have a small update..

I am setting up SIM 7.3 and also IRS for agentless monitoring.  I was also trying to work around the firewall issue with ESXi 5.1 and WBEM agents.  What I found is this:

- Agentless monitoring enabled on the iLO

- SNMP trap destinations and communities set up in the iLO

- Discoveries through the iLO using SNMP credentials (no host discoveries, only the iLO)

- AMS service/daemon running on the ESXi host

- Gen8 systems only

I now see events forwarded from the ESXi host, through the iLO. I did NOT add WBEM credentials or set up WBEM subscriptions, so I know no WBEM events are being forwarded.  What I end up seeing in the server record is a "major" event status for test events (in both the server events and the iLO events page) and also "critical" events for any actual alert.  I have a few hosts that had issues and after discovery, I am seeing HBA events and one server has a failed disk drive.  If i look at the server's health status, I only see SNMP as a protocol, and the failing component.

Now, I do have the full agent bundles on the servers, i have not tested this with AMS ONLY.  However, this "fixes" the issue for me, for now.  I am going to see about removing the complete bundles from Update Manager for new ESXi builds to see if this is still working this way.  We don't want to continue using the complete bundles anyhow since it's redudant.  I just want AMS + the utilities.

I hope this helps..  if anyone can verify that this works with just AMS, that would be great.  I'll try to test on my own as well.

I have also not tested this on SIM 7.2.2, but I assume it works the same way since it avoids WBEM traps completely.

[MichaelHayes]

1. I have enabled the following ports:

nc -z 10.1.214.89 5989 (WBEM Service) HTTPS

nc -z 10.1.214.89 5988 (WBEM Service) HTTP

nc -z 10.1.214.89 50005 (WBEM Events) WBEM

nc -z 10.1.214.89 50004 (WBEM event receiver) HTTPS/HTTP

2. Sent test event and never was recieved by HP SIM server.

/opt/hp/tools/./hptestevent

But if I disable the firewall all together and sent test event it works.

esxcli network firewall set --enabled false (turn firewall off)

Is anyone aware of any other ports that need to be opened?

[MichaelHayes]

I am going to create a custom firewall rule and let you know if this resolves the issue.

I believe it is not as simple as running the commands. Stay tuned.

[MichaelHayes]

OK everyone I have the answer to receive WBEM events from ESXi 5.1 hosts to HP CIM 7.0.2

You need to edit the /etc/vmware/firewall/serivces.xml file and add an entry for customized ports in the firewall.

Scroll to bottom of file and add the entry in the attachment but then you need to make it persistent as it will disappear after reboots.

Use this test command from ESXi for host to send event from HP SIM.

/opt/hp/tools/./hptestevent

;-)

[MichaelHayes]

Update in order to be peristent you must install a VIB but there are concerns with going this route:
I am waiting for an alternative from VMware.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2007381