4 Replies Latest reply on Jul 1, 2014 5:52 PM by JimmyLeunglkm

    Consolidating alerts

    JimmyLeunglkm Novice

      The situation is like this, i tried to configure a consolidated alert based on a super metric

       

      What i have done right now (Im using vapp and both xml are modified in analytics vm):
      Created and assigned super metric for the resource (in consolidated-alert-definition.xml)

      <definition id="Hardware Temperature Test" count="1" percentage="" waitCycles="0" cancelCycles="2" resourceKinds="" resourcesIds="">

              <condition attributeKey="Super Metric|Processor1-TempC" resourceKind="HostSystem" minDuration="" criticality="" alertType="" alertSubtype="" inforRegEx="" />

      </definition>

       

      Then emailFilter.xml:

      <FilterRule name="YES IT WORKS">

              <Conditions>

                <condition type="AlertType">Hardware Temperature Test</condition>

                <condition type="Status">New</condition>

              </Conditions>

              <Addresses>

                  <sendTo type="email">my email</sendTo>

              </Addresses>

          </FilterRule>

          <FilterRule name="No Space IT WORKS">

              <Conditions>

                <condition type="AlertType">HardwareTemperatureTest</condition>

                <condition type="Status">New</condition>

              </Conditions>

              <Addresses>

                  <sendTo type="email">my email</sendTo>

              </Addresses>

          </FilterRule>

       

      Caz i dont know can there be space in the AlertType, or should it be Consolidated.

       

      What i got right now is that i can see the alert pop up in the alert overview, but it is classified as Classic Alert(Notification), but not consolidated as i want.


      Anyone can see whats wrong with it? Thx guys

        • 1. Re: Consolidating alerts
          mark.j Master
          VMware Employees

          The alerttype is invalid in your filter rule. See the custom ui admin guide for the table of valid alerttypes as this is a fixed list.

           

          Also, your attribute key for the Supermetric may need to be in a diff format, e.g. Super Metric|sm_4... 4 being the SM id.

          1 person found this helpful
          • 2. Re: Consolidating alerts
            JimmyLeunglkm Novice

            Thx mark, checked again for the alertType and its working for normal metrics now.

             

            Consolidated alert definition

            <definition id="Cpu_Usage_Avg" count="1" percentage="" waitCycles="0" cancelCycles="2" resourceKinds="VirtualMachine" resourcesIds="">

                 <condition attributeKey="cpu|usage_average" resourceKind="" minDuration="" criticality="" alertType="" alertSubtype="" inforRegEx="" />

            </definition>

             

            Alert-hints

            <kbItem>

                    <condition attributeKey="cpu|usage_average" resourceKind="VirtualMachine" minDuration="" criticality="" alertType="Consolidated Alerts" alertSubtype="" infoRegEx="" eventClass="" eventSubclass="" />

                    <text>Alert Hints for Consolidated Alert_cpu</text>

            </kbItem>

             

            I cannot get the alert hints to be displayed in the email noti for consolidated alert i send out, but for the classic alerts it works fine.

             

            Spot any mistakes?

            • 3. Re: Consolidating alerts
              mark.j Master
              VMware Employees

              If you hints are getting included, you need to look at the consolidated alert templates. These templates decide what you get in your alert e-mails. For alert hints, you'd probably want to see:

               

                 Alert Root Cause: {{AlertRootCause}}

                 Alert Root Cause Details: {{AlertRootCauseDetails}}

                 Anomalies: {{Anomalies}}

               

              Is that about right? See the templates in '/usr/lib/vmware-vcops/user/plugins/outbound/filter_alertplugin/conf/default_templates' to edit.

              • 4. Re: Consolidating alerts
                JimmyLeunglkm Novice

                I did read through the information, and i spot a placeholder {{AlertHints}}

                 

                I could get it working for the alerts rules defined in emailFilter.xml, so that i can see subject like this: xxxxxxx [VM WARNING] xxxxx

                But then for consolidated alert, I only got [] for the alert hint placeholder.

                 

                Will that placeholder work for consolidated alert?