Consolidating alerts

[JimmyLeunglkm]

The situation is like this, i tried to configure a consolidated alert based on a super metric

What i have done right now (Im using vapp and both xml are modified in analytics vm):
Created and assigned super metric for the resource (in consolidated-alert-definition.xml)

<definition id="Hardware Temperature Test" count="1" percentage="" waitCycles="0" cancelCycles="2" resourceKinds="" resourcesIds="">

        <condition attributeKey="Super Metric|Processor1-TempC" resourceKind="HostSystem" minDuration="" criticality="" alertType="" alertSubtype="" inforRegEx="" />

</definition>

Then emailFilter.xml:

<FilterRule name="YES IT WORKS">

        <Conditions>

          <condition type="AlertType">Hardware Temperature Test</condition>

          <condition type="Status">New</condition>

        </Conditions>

        <Addresses>

            <sendTo type="email">my email</sendTo>

        </Addresses>

    </FilterRule>

    <FilterRule name="No Space IT WORKS">

        <Conditions>

          <condition type="AlertType">HardwareTemperatureTest</condition>

          <condition type="Status">New</condition>

        </Conditions>

        <Addresses>

            <sendTo type="email">my email</sendTo>

        </Addresses>

    </FilterRule>

Caz i dont know can there be space in the AlertType, or should it be Consolidated.

What i got right now is that i can see the alert pop up in the alert overview, but it is classified as Classic Alert(Notification), but not consolidated as i want.

Anyone can see whats wrong with it? Thx guys

[mark_j]

The alerttype is invalid in your filter rule. See the custom ui admin guide for the table of valid alerttypes as this is a fixed list.

Also, your attribute key for the Supermetric may need to be in a diff format, e.g. Super Metric|sm_4... 4 being the SM id.

[JimmyLeunglkm]

Thx mark, checked again for the alertType and its working for normal metrics now.

Consolidated alert definition

<definition id="Cpu_Usage_Avg" count="1" percentage="" waitCycles="0" cancelCycles="2" resourceKinds="VirtualMachine" resourcesIds="">

     <condition attributeKey="cpu|usage_average" resourceKind="" minDuration="" criticality="" alertType="" alertSubtype="" inforRegEx="" />

</definition>

Alert-hints

<kbItem>

        <condition attributeKey="cpu|usage_average" resourceKind="VirtualMachine" minDuration="" criticality="" alertType="Consolidated Alerts" alertSubtype="" infoRegEx="" eventClass="" eventSubclass="" />

        <text>Alert Hints for Consolidated Alert_cpu</text>

</kbItem>

I cannot get the alert hints to be displayed in the email noti for consolidated alert i send out, but for the classic alerts it works fine.

Spot any mistakes?

[mark_j]

If you hints are getting included, you need to look at the consolidated alert templates. These templates decide what you get in your alert e-mails. For alert hints, you'd probably want to see:

   Alert Root Cause: {{AlertRootCause}}

   Alert Root Cause Details: {{AlertRootCauseDetails}}

   Anomalies: {{Anomalies}}

Is that about right? See the templates in '/usr/lib/vmware-vcops/user/plugins/outbound/filter_alertplugin/conf/default_templates' to edit.

[JimmyLeunglkm]

I did read through the information, and i spot a placeholder {{AlertHints}}

I could get it working for the alerts rules defined in emailFilter.xml, so that i can see subject like this: xxxxxxx [VM WARNING] xxxxx

But then for consolidated alert, I only got [] for the alert hint placeholder.

Will that placeholder work for consolidated alert?