Object Types and Attributes Monitored on VMware Servers

Review a full list of object types and attributes Netwrix Auditor can collect on VMware server (standalone host or vCenter server).

Object type	Attributes
Virtual Machine	Annotation Check and upgrade Tools Connect at power on Connected Current Snapshot Disable Acceleration Enable Logging Force BIOS Setup Guest OS Guest OS Version Guest Power Management Guest State Hardware Page Table Virtualization Hyper-threaded Core Sharing Memory Size (M) Notes Number of virtual processors Operation mode of guest OS Power Off Type Power On Power State Power-on Boot Delay Record Debugging Information Reset Type Resource Pool Run VMware Tools Scripts After Powering On Run VMware Tools Scripts After Resuming Run VMware Tools Scripts Before Powering Off Run VMware Tools Scripts Before Suspending Snapshot Description Snapshot Name Suspend Type Synchronize guest time with host Swap file Location Template Virtual Machine Name VirtualCdrom Device Type VirtualCdrom Mode VirtualDisk Capacity(K) VirtualDisk Datastore VirtualDisk Disk Mode VirtualDisk Share Level VirtualDisk Unit Number VirtualFloppy Device Type VirtualParallelPort Connection VirtualPCNet32 MAC Address Type VirtualPCNet32 MAC Address VirtualPCNet32 Wake on LAN VirtualSerialPort Connection VirtualSerialPort Far End VirtualSerialPort Near End VirtualSerialPort Yield CPU on poll VirtualSCSIController Controller Type VirtualSCSIController Bus Sharing VirtualSCSIController Bus Number
Authorization Manager	Authorization Manager Name Privilege
Cluster Resource	Available CPU Available Hosts Available Memory Name Swap Policy for Virtual Machines VMware DRS VMware DRS Automation Level VMware DRS Migration threshold VMware DRS Power Management VMware DRS 'Keep Virtual Machines Together' Rule Name VMware DRS 'Keep Virtual Machines Together' Rule Enabled VMware DRS 'Keep Virtual Machines Together' Rule Status VMware DRS 'Keep Virtual Machines Together' Rule Virtual Machine VMware DRS 'Separate Virtual Machines' Rule Name VMware DRS 'Separate Virtual Machines' Rule Enabled VMware DRS 'Separate Virtual Machines' Rule Status VMware DRS 'Separate Virtual Machines' Rule Virtual Machine VMware DRS Virtual Machine Automation Mode VMware HA VMware HA Admission Control VMware HA Isolation Response VMware HA Restart Priority VMware HA Number of host failures allowed VMware HA Advanced Option VMware HA Isolation Response VMware HA Restart Priority
Computer Resource	Name
Datacenter	Name
Data Store	Accessible Name
Distributed Port Group	Name Distributed Virtual Switch Ports Number Uplink
Distributed Switch	Name Port Group Uplink Port
Folder	Folder Name
Host System	Configuration Status CPU Expandable Reservation CPU Limit CPU Reservation CPU Shares Level CPU Shares Datastore accessible to Host Memory Expandable Reservation Memory Limit Memory Reservation Memory Shares Level Memory Shares NTP required NTP uninstallable NTP running NTP policy NTP Servers Overall Status Port Group Allow Promiscuous Port Group MAC Address Changes Port Group Forged Transmits Port Group VLAN ID Port Group Attached uplink adapter Service Console IP Address of port Virtual Switch Allow Promiscuous Virtual Switch MAC Address Changes Virtual Switch Forged Transmits Virtual Switch Number of Ports Virtual Switch Attached uplink adapter VMkernel IP Address of port
Resource Pool	Name
VirtualApp	Name Child Parent Folder

 

Considerations and Limitations

The following considerations refer to VMware infrastructure monitoring with Netwrix Auditor:

• A VM that was moved from one resource pool to another (within the same VMware host) will be reported as Modified.
• If an ESXi host was specified as a monitored item in the corresponding monitoring plan, but a virtual machine was created using the vCenter Server (not this ESXi host) management facilities, information about this VM creation will not be collected. To work around, specify the vCenter Server as a monitored item in the monitoring plan.
• For ESXi host permission changes, the "What" field in the Activity Records (and, therefore, reports and search results) will report \root.
• Netwrix Auditor will not collect data on Failed Logon event in case of incorrect logon attempt through VMware vCenter Single Sign-On.
• Also, data on the logon attempts performed using SSH will not be collected.
• For custom role creation event, initiator will be reported as System.