Recently got a request to add Alarms + Email notification whenever SSH is enabled in the hosts for security audit purpose. Seems easy enough until you found out vSphere doesn’t ship with out-of-the-box alert for this kind of events.
Fortunately, William Lam has a good reference for vCenter VOB alarms that you can use to define the event. One of those alarm is:
esx.audit.ssh.enabled
Which triggers when SSH is enabled.
That’s it!
Just create Alarm, create Host State -> add in: esx.audit.ssh.enabled. and you’re all set.
Link of the Reference VOB’s here: http://www.virtuallyghetto.com/2014/04/other-handy-vsphere-vobs-for-creating-vcenter-alarms.html
Enjoy!
