Windows Server 2012 : Monitoring, Tuning, and Troubleshooting Hyper-V - Using VM Monitoring

7/14/2013 7:29:17 PM

System monitoring is the process of determining and finding problems in any of your servers, either physical or virtual.

VM Monitoring is a great assistant for virtual machine monitoring in clustered environments and helps to detect whether a virtual machine is running in a critical state. It will allow you to check the health of the VM service at the host level, identifying issues using events and status messages. VM Monitoring also enables the host to start a task to solve the problem in a proactive way, with no user interaction. In other words, it will check whether something is wrong, and if necessary, it will try to fix the problem automatically.

This recipe will show you how to prepare the virtual machine and the Management OS to use VM Monitoring.

Getting ready

There are some prerequisites that you need to note before you start. The first thing is that VM Monitoring is only available on virtual machines running on a cluster. All the host computer configurations are done through the Failover Cluster Manager console.

The virtual machine must be part of the same domain as the Management OS, and the user used to administer Failover Clustering must be a member of the local administrators group in the VM.

Last but not least, VM Monitoring is only available on virtual machines that run Windows Server 2012.

How to do it...

The following steps will demonstrate how to prepare the virtual machine to be monitored by VM Monitoring, how to enable it from the host so as to monitor a service, how to monitor Event Viewer entries within the VM, and how to check the VM Monitoring results:

To configure the VM to be monitored using VM Monitoring, open the Failover Cluster Manager console from one of the cluster nodes (or a machine that has Failover Cluster Manager installed) by typing cluadmin.msc on the Start menu.
In the Failover Cluster Manager window, expand your cluster, click on Roles, select the virtual machine that you want to prepare for use with VM Monitoring, and click on Connect in the right-hand pane.
Make sure the VM is started, and log in using a local administrator account.
To create a Windows Firewall exception, launch the Start menu and type firewall. In the right-hand pane, click on Settings and select Windows Firewall.
On the left-hand pane, click on Allow an app or feature through Windows Firewall.
In the Windows Firewall window, click on Change settings.
Under Allowed apps and features, select Virtual Machine Monitoring and select the networks you are connected with, as shown in the following screenshot:
Note
You can also configure the VM Monitoring firewall exception using the following command:
```
Set-NetFirewallRule -DisplayGroup "Virtual Machine Monitoring" -Enabled True
```
To configure the recovery service action on the service that will be monitored, launch the Start menu and type services.msc to open the Services console.
In the Services console, in the service list, double-click on the service you want to monitor and click on the Recovery tab.
Select the actions for First failure, Second failure, and Subsequent failures, as shown in the following screenshot.
When finished, close all windows and virtual machine connections.
To configure VM Monitoring to monitor a service, from the Management OS, open the Failover Cluster Manager console again, right-click on the virtual machine you configured to enable VM Monitoring, select More Actions, and click on Configure Monitoring.
In the Select Services window, select the service you want to monitor and click on OK, as shown in the following screenshot:
If you want to add a service that is not in the service list, type the following command from one of the failover cluster nodes, changing SYD-SP1 to the virtual machine name and MyApplication to the service name you want to add:
```
Add-ClusterVMMonitoredItem –VirtualMachine SYD-SP1 –Service MyApplication
```
To configure VM Monitoring to monitor an event from Event Viewer, open the virtual machine connection again.
From the VM, open Server Manager.
In the Server Manager window, click on Manage in the right-hand pane and click on Add Roles and Features.
In the Add Roles and Features Wizard window, click on Next four times.
In the Select features section, expand Remote Server Administration Tools | Feature Administration Tools | Failover Clustering Tools, and select Failover Cluster Modules for Windows PowerShell, as shown in the following screenshot. Click on Next and then Finish to start the installation.
On the VM, open PowerShell and type the following command by replacing Application with the event log you want to monitor, MyApplication with the event source you will use, and 123 with the event ID VM Monitoring will monitor:
```
Add-ClusterVMMonitoredItem –EventLog "Application" –EventSource "MyApplication" –EventID 123
```
To change the default action triggered on the host computer when one of these monitoring resources is alerted, open Failover Cluster Manager, select the virtual machine in Roles, and click on the Resources tab at the bottom.
In the Resources tab, right-click on the virtual machine and click on Properties.
In the properties window for the virtual machine, select the Policies tab and configure the response to resource failure options. The default configuration, which is shown in the following screenshot, will attempt to restart the virtual machine if one of the configured VM Monitoring is triggered. If the restart is unsuccessful, the VM will fail over to another node in the cluster.
To check the virtual machine monitoring status, select the virtual machine in Failover Cluster Manager and check the Status details.
If the virtual machine has triggered one of the monitored options, a status showing Running (Application in VM Critical) will be displayed, as shown in the following screenshot:
To check the status on all virtual machines using PowerShell, type the following command from one of the nodes that is a member of the cluster:
```
Get-ClusterResource | fl StatusInformation
```
To check the virtual machine status using Event Viewer, open Event Viewer in one of the failover cluster nodes.
In the Event Viewer window, expand Windows Logs and click on System. Click on Event ID to list events by ID, and double-click on the event with the ID 1250; you will see the following screen:

How it works...

VM Monitoring can be enabled on every virtual machine with Windows Server 2012 running in a cluster, to monitor services and events from the host computer without the need to connect to the VM to check its status.

VM Monitoring requires that the virtual machine be in the same domain as the host computer. It also needs the failover cluster administrator that is used to set VM Monitoring to be a member of the local administrator group within the VM.

After these prerequisites, a firewall exception to allow VM Monitoring must be created to allow the Management OS to connect to the VM.

When monitoring a service, you can specify what will happen within the VM in case of service failure, by using the Recovery tab from the Services console. It allows three actions in a different order to be configured and can be used to automatically carry out an action, such as sending an e-mail or running a script to solve the problem.

Using Failover Cluster Manager, you can enable VM Monitoring by selecting which services you want to monitor. In case the service is not listed, the command Add-ClusterVMMonitoredItem can be used from the host computer, to add it to the list.

Although it is not available using the graphical interface, Event Viewer logs can also be monitored on your VMs, using PowerShell. The necessary commands used to enable Event Viewer monitoring are part of the Failover Clustering module and need to be installed within the VM.

From the node members of the cluster where the VMs sit, you can use the status information from Failover Cluster Manager or use Event Viewer, searching for the event ID 1250 on the system log, to check whether one of the monitored items was triggered.

When a problem is found by the cluster, the VM is restarted by default, and in case of failures, a failover process occurs. These failure actions can be changed through the virtual machine properties. Rather than carrying out an action, you can create an Event Viewer task to send an alert to the IT team with the status information, for example.

Although VM Monitoring is very handy, it is not enough. It is important to think about other monitoring tools that can give more details and alerts from your whole infrastructure, with reports and advanced features. A good example is System Center Operations Manager, a server where you can centralize all monitoring data, which can include servers, applications, network devices, desktops, and many other components from different brands and providers.