Alerts to vROps are not associated with correct object

[daphnissov]

Versions involved are vRLI 4.5 and vROps 6.6. The vRLI agent is installed on a VM which is being monitored by vROps. Integrations are configured between the two products. One can view the logs of the VM from within vROps successfully. The logs sent by the vRLI agent to vRLI have the correct vROps ID embedded. But when configuring an alert based on a query for this VM that goes to vROps, it never associates the alert inside vROps with the correct object, always with the fallback object. The query was tested with both the "hostname" field or "vmw_vr_ops_id" field, and neither was successful. The alert is configured to fire when less than X events received in Y time. What are some troubleshooting steps to follow in these cases?

Edited to show fields involved in query and alert.

[admin]

I think you need to Edit the alert to modify the fallback object to point to the correct object. The default is the default fall back object and looks like the alert is going to this default object as opposed to the object (VM ) you need.

[daphnissov]

I was hoping and expecting that the integration was intelligent enough to automatically match the object up. That's what the info suggests, anyway. Otherwise, what's the point in a fall back object if the relationship has to be explicitly set on every alert?

[daphnissov]

The above is text from the information button on the Fallback object field in the alert definition. So to re-word my question:  Why isn't the alert finding the match in vROps' inventory? It seems like it should, and because it fails it is falling back to the default object.

[admin]

If you click the button to select an object do you see the object you need listed there ? If yes then select it and if alert is still not going to it then its a bug. But if you do not see it there then vRLI is unable to find the right object in the vROps inventory and will need to be looked at in vROps settings as to what is different for this object as opposed to those that vRLI is able to find.

[daphnissov]

Hi yogitap​, yes, I see the object in the list. But what I'm saying here is that why is this necessary in the first place? The description of a fallback object clearly states "A notification will be sent to the selected vRealize Operations Manager fallback object if a matching object is not found. My point is that a matching object *is* found. It's there, in the system, and the IDs even match. But vRLI or vROps is instead preferring the fallback object instead.

[admin]

Thanks for checking to make sure the object is found. I do understand what you are saying though and I think it is likely a bug . Have you tried to remove and re-add the vROps integration ?  This will get the latest inventory mapping information from vROps and might fix the issue. If it still does not I suggest to file a bug with us and send us a support bundle.

You can get some more details here - 3 Reasons Why You Should Integrate Log Insight with vRealize Operations - SFlanders.net

[daphnissov]

Ahh, thanks for point that article out. Even though I read it, I skipped over this part:

And here's my alert configuration:

Since I'm using the third radio button, I guess this is the issue. But if sflanders​'s article was written 2.5 years ago, is that limitation still in effect? If so, is there some technical reason why it *shouldn't* work? I'm trying to understand why that third option is so special as to not be able to match up to the correct vROps inventory object...

[admin]

Yes the article was written 2.5 years ago but most of it still applies hence I pointed you to it. Have you tried with any of the other two options.

Unrelated but some other information about this integration is here - https://blogs.vmware.com/management/2017/06/announcing-vmware-vrealize-log-insight-4-5-release-whats...

[admin]

Unrelated but is that a Irish Wolfie in your profile pic ...sorry but I am fan of that breed.

[daphnissov]

I haven't tried with either of the other two options because they don't work for what I'm trying to accomplish (alert when something stops sending logs).

I think the picture is of a Scottish Terrier, but it's a default picture that was either auto-selected or I selected and I don't remember. I do like Irish Wolfhounds though but am partial to Saint Bernards .

[admin]

I haven't tried with either of the other two options because they don't work for what I'm trying to accomplish (alert when something stops sending logs). - Ok for this case I think you should just create the custom alert in the way I mentioned in the Option 2 in an earlier response it will help with what you are looking to do.

I think the picture is of a Scottish Terrier, but it's a default picture that was either auto-selected or I selected and I don't remember. I do like Irish Wolfhounds though but am partial to Saint Bernards . Ha ha ...I like Saint Bernards too ...gentle giants... but Irish Wolfhounds are my favorite ... sorry to ask you non-tech question here.

[daphnissov]

Will do. But seriously, can we get that third radio button to work at some point? It sure seems like a bug when it doesn't work and there's no indication why (other than Steve's 2.5-year-old blog post).

[admin]

Yes I will look into it and file a bug as necessary thanks for reporting it.