Object Types and Attributes Monitored on VMware Servers

Review a full list of object types and attributes Netwrix Auditor can collect on VMware server (standalone host or vCenter server).

Object type Attributes

Virtual Machine
  • Annotation
  • Check and upgrade Tools
  • Connect at power on
  • Connected
  • Current Snapshot
  • Disable Acceleration
  • Enable Logging
  • Force BIOS Setup
  • Guest OS
  • Guest OS Version
  • Guest Power Management
  • Guest State
  • Hardware Page Table Virtualization
  • Hyper-threaded Core Sharing
  • Memory Size (M)
  • Notes
  • Number of virtual processors
  • Operation mode of guest OS
  • Power Off Type
  • Power On
  • Power State
  • Power-on Boot Delay
  • Record Debugging Information
  • Reset Type
  • Resource Pool
  • Run VMware Tools Scripts After Powering On
  • Run VMware Tools Scripts After Resuming
  • Run VMware Tools Scripts Before Powering Off
  • Run VMware Tools Scripts Before Suspending
  • Snapshot Description
  • Snapshot Name
  • Suspend Type
  • Synchronize guest time with host
  • Swap file Location
  • Template
  • Virtual Machine Name
  • VirtualCdrom Device Type
  • VirtualCdrom Mode
  • VirtualDisk Capacity(K)
  • VirtualDisk Datastore
  • VirtualDisk Disk Mode
  • VirtualDisk Share Level
  • VirtualDisk Unit Number
  • VirtualFloppy Device Type
  • VirtualParallelPort Connection
  • VirtualPCNet32 MAC Address Type
  • VirtualPCNet32 MAC Address
  • VirtualPCNet32 Wake on LAN
  • VirtualSerialPort Connection
  • VirtualSerialPort Far End
  • VirtualSerialPort Near End
  • VirtualSerialPort Yield CPU on poll
  • VirtualSCSIController Controller Type
  • VirtualSCSIController Bus Sharing
  • VirtualSCSIController Bus Number

Authorization Manager
  • Authorization Manager Name
  • Privilege

Cluster Resource
  • Available CPU
  • Available Hosts
  • Available Memory
  • Name
  • Swap Policy for Virtual Machines
  • VMware DRS
  • VMware DRS Automation Level
  • VMware DRS Migration threshold
  • VMware DRS Power Management
  • VMware DRS 'Keep Virtual Machines Together' Rule Name
  • VMware DRS 'Keep Virtual Machines Together' Rule Enabled
  • VMware DRS 'Keep Virtual Machines Together' Rule Status
  • VMware DRS 'Keep Virtual Machines Together' Rule Virtual Machine
  • VMware DRS 'Separate Virtual Machines' Rule Name
  • VMware DRS 'Separate Virtual Machines' Rule Enabled
  • VMware DRS 'Separate Virtual Machines' Rule Status
  • VMware DRS 'Separate Virtual Machines' Rule Virtual Machine
  • VMware DRS Virtual Machine Automation Mode
  • VMware HA
  • VMware HA Admission Control
  • VMware HA Isolation Response
  • VMware HA Restart Priority
  • VMware HA Number of host failures allowed
  • VMware HA Advanced Option
  • VMware HA Isolation Response
  • VMware HA Restart Priority

Computer Resource
  • Name

Datacenter
  • Name

Data Store
  • Accessible
  • Name
Distributed Port Group
  • Name
  • Distributed Virtual Switch
  • Ports Number
  • Uplink
Distributed Switch
  • Name
  • Port Group
  • Uplink Port

Folder
  • Folder Name

Host System
  • Configuration Status
  • CPU Expandable Reservation
  • CPU Limit
  • CPU Reservation
  • CPU Shares Level
  • CPU Shares
  • Datastore accessible to Host
  • Memory Expandable Reservation
  • Memory Limit
  • Memory Reservation
  • Memory Shares Level
  • Memory Shares
  • NTP required
  • NTP uninstallable
  • NTP running
  • NTP policy
  • NTP Servers
  • Overall Status
  • Port Group Allow Promiscuous
  • Port Group MAC Address Changes
  • Port Group Forged Transmits
  • Port Group VLAN ID
  • Port Group Attached uplink adapter
  • Service Console IP Address of port
  • Virtual Switch Allow Promiscuous
  • Virtual Switch MAC Address Changes
  • Virtual Switch Forged Transmits
  • Virtual Switch Number of Ports
  • Virtual Switch Attached uplink adapter
  • VMkernel IP Address of port

Resource Pool
  • Name
VirtualApp
  • Name
  • Child
  • Parent Folder

 

Considerations and Limitations

The following considerations refer to VMware infrastructure monitoring with Netwrix Auditor:

  • A VM that was moved from one resource pool to another (within the same VMware host) will be reported as Modified.
  • If an ESXi host was specified as a monitored item in the corresponding monitoring plan, but a virtual machine was created using the vCenter Server (not this ESXi host) management facilities, information about this VM creation will not be collected. To work around, specify the vCenter Server as a monitored item in the monitoring plan.
  • For ESXi host permission changes, the "What" field in the Activity Records (and, therefore, reports and search results) will report \root.
  • Netwrix Auditor will not collect data on Failed Logon event in case of incorrect logon attempt through VMware vCenter Single Sign-On.
  • Also, data on the logon attempts performed using SSH will not be collected.
  • For custom role creation event, initiator will be reported as System.