Guest Introspection Events

Events are used for logging and auditing conditions inside the Guest Introspection-based security system.

Events can be displayed without a custom vSphere plug-in. See the vCenter Server Administration Guide on events and alarms.

Events are the basis for alarms that are generated. Upon registering as a vCenter Server extension, the NSX Manager defines the rules that create and remove alarms.

Common arguments for all events are the event time stamp and the NSX Manager event_id.

Event Code	Event Severity	Alarm Triggered	Event Message	Description
26000	Informational			The Guest Introspection thin agent running in a guest VM is enabled. This event is reported when a VM is added to the VC inventory or when either the VM or NSX Manager is restarted. Action: Information-only event.
26001	Informational			The Guest Introspection service deployment process has succeeded, and the Service Status of the GI SVM (USVM) is up. Action: Information-only event.
26002	Medium			The thin agent version in the guest VM is not compatible with the EPsec library version in the partner SVM or the USVM. Action: Update the thin agent version in the guest VM.
26003	Medium			The ESX GI module (MUX) failed to establish a connection with the USVM. This event may be reported after the guest VM attempted to connect to the USVM to send health status reports. Action: Confirm the GI SVM (USVM) is powered on, and service status appears as up in the Service Deployment tab.
26004	Medium			The ESX GI module (MUX) failed to establish a connection with the USVM. This event may be reported after the guest VM attempted to connect to the USVM to send health status reports. Action: Confirm the GI SVM (USVM) is powered on, and service status appears as up in the Service Deployment tab.
26005	Informational			The ESX GI module (MUX) was installed successfully. Action: Information-only event for each host on which Guest Introspection is deployed.
26006	Informational			The ESX GI module (MUX) was uninstalled. Action: Information-only event for each host on which the Guest Introspection host module is no longer running.
26007	Informational			NSX Manager failed to receive the host module's health status report for up to three minutes. The Service Status column for the cluster in the Service Deployment tab will be in a warning state. Action: This event may be a transient event during service deployment. If it persists, collect the GI SVM and host technical support logs (vmware.log) and open a technical support request.