Multiple Symptom Definitions Groups for an Alert

[MBouillon]

Greetings!

I am trying to figure out how to create an Alert definition, similar to the pre-canned 'One or more virtual machine guest file systems are running out of disk space' Alert that has 3 symptoms based on drive space usage percentage.  Those symptoms fire when drive usage reaches 95, 90, and 85 percent of capacity.  While this pre-canned alert works fine with 80% of our VMs, it does not work how I would like it to work when a vm has a very large volume.  As an example, we have a few vm's that have a 1TB drive.  When usage on that drive reaches 850GB, i start receiving alerts.  What I tried to do was add 3 additional symptoms for Critical, Immediate, and Warning.  I set the symptom criteria for those 3 symptoms to 'is less than' 50GB.

In my screenshot, I thought the logic would be if any in the first group were true AND if any in the second group were true, then display an alert.

Thanks for any insight!

Marty

[sxnxr · Accepted solution]

I dont do this for vms but i do for datastores. The way i do it is separate alerts

One for normal sized and one for lard datastores.

i create sub policy off my main policy for each group i want to create and disable the normal alerts for the datastore in them and enable the new alerts for the different groups in each sub policy.

I then custom groups with membership rules for greater than 10tb and less than 20tb and a second for 20.1 to 30 and so on and assingn the correct policy to that group that has the alerts enabled in them

I hope this makes sense

I know it does not answer your question but may be an alternative

[MBouillon]

Thanks sxnxr!  That does make sense and will certainly solve this problem.