Skip to main content

 

Splunk Lantern

VMotion events for a specific virtual machine

VMotion is the process of moving a virtual machine from one ESXi host to another in an effort to balance the workload of all virtual machines as evenly and effectively as possible. You might need to track VMotion events for a specific virtual machine when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

While the VMotion process is seamless to the virtual machine operation, it can impact performance. You want to monitor virtual machines being moved from one ESXi host to another so you can be prepared for any problems caused by the process. 

To optimize the search shown below, you should specify an index and a time range.

  1. Ensure that you have installed the IT Essentials Work app to onboard VMware data and provide the various VMware entity type configurations and dashboards.
  2. Ensure that you are collecting VMware data through one or more Data Collection Nodes, which are essentially Splunk heavy forwarders with specific VMware collection configurations. 
  3. Run the following search: 
index=vmware-taskevent sourcetype="vmware_inframon:events" eventClass="VmMigratedEvent" vm.name="<VM_NAME>"
| stats count BY vm.name, eventClass, createdTime, sourceHost.name, host.name, sourceDatastore.datastore.moid, ds.datastore.moid, _time
| rename vm.name AS "VM" eventClass AS "Event Type" createdTime AS "Completed Time" host.name AS "Dest. ESXi" sourceHost.name AS "Src ESXi" sourceDatastore.datastore.moid AS "Src Datastore" ds.datastore.moid AS "Dest.Datastore" 
| fields - count

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
index=vmware-taskevent sourcetype="vmware_inframon:events" eventClass="VmMigratedEvent" vm.name="<VM_NAME>"

Search index vmware-taskevent for Virtual Machine migrated events. 

Replace <VM_NAME> with the Virtual Machine name or use * for all VMotions.

| stats count BY vm.name, eventClass, createdTime, sourceHost.name, host.name, sourceDatastore.datastore.moid, ds.datastore.moid, _time

Search only virtual machines.

| rename vm.name AS "VM" eventClass AS "Event Type" createdTime AS "Completed Time" host.name AS "Dest. ESXi" sourceHost.name AS "Src ESXi" sourceDatastore.datastore.moid AS "Src Datastore" ds.datastore.moid AS "Dest.Datastore" 

Rename the fields as shown for readability.

| fields - count

Remove the count field from the results.

Result

Provide this data to application teams so they can correlate VMWare activity with application performance and behavior.

  • Was this article helpful?