Pattern 11 : TaskManager : Task Manager Messages
Vendor Documentation
https://www.vmware.com/in/products/esxi-and-esx.html https://www.vmware.com/topics/glossary/content/bare-metal-hypervisor |
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Pattern 11 : TaskManager : Task Manager Messages | Base Rule | General Information | Information |
haTask-ha-host-vim.DiagnosticManager.browse | Sub Rule | Process/Service Started | Startup and Shutdown |
haTask-ha-host-vim.DiagnosticManager.browse | Sub Rule | Task Completed | Information |
haTask-16-vim.VirtualMachine.powerOff Started | Sub Rule | Process/Service Started | Startup and Shutdown |
haTask-16-vim.VirtualMachine.powerOff Completed | Sub Rule | System Shutdown | Startup and Shutdown |
haTask-16-vim.VirtualMachine.powerOn Completed | Sub Rule | System Started | Startup and Shutdown |
haTask-16-vim.VirtualMachine.powerOn Created | Sub Rule | Virtual Machine Startup Task Created | Information |
haTask-ha-host-vim.option.OptionManager Created | Sub Rule | Process/Service Started | Startup and Shutdown |
haTask-ha-host-vim.option.OptionManager Completed | Sub Rule | Task Completed | Information |
TaskManager : General Task Completed | Sub Rule | Task Completed | Information |
TaskManager : General Task Created | Sub Rule | Task Completed | Information |
haTask-ha-folder-root-vim.host.LclAcctmgr.CrtUsr | Sub Rule | User Account Created | Account Created |
haTask-ha-folder-root-vim.host.LclAcctMgr.RmvUsr | Sub Rule | User Account Deleted | Account Deleted |
haTask-ha-host-vim.HostSystem.reboot | Sub Rule | System Reboot Task Created | Information |
haTask-ha-host-vim.HostSystem.reboot | Sub Rule | System Restarted | Startup and Shutdown |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
---|---|---|
Process | <process> | Text/String |
Tag1 | <tag1> | Text/String |
Tag2 | <tag2> | Text/String |
Vmid | <vmid> | Text/String |