Log Insight - Automate Alerts Creation

[wwandrei]

Hello. I have this issue \ topic: Let`s say that I need to integrate 8 vCenters into one LogInsight instance and then create alerts on different type of queries (vsphere red alerts - custom, vsphere tasks, events ... etc). Once an alert  is generated is being sent to vCOPS (email alert  is out of question) and vCOPS generates an outbound alert and sends it via SNMP to a 3rd party tool. Since there are  8 vCenters and in vCOPS you will only have the Alert name in the filed meaning that for a single type of alert I need to duplicate it to 8 so I know to which vCenter  it refers to (I won`t come into details saying that I need to integrate also other components)  ... so how can I automate alerts creation (is there any LogInsight API that can be called ? or scripts!?) Also resource mappings between Loginsight and vCOPS (automation I mean not manually while creating the alert) would be interesting. Thanks!

[sflanders]

No API for alert creation, but you could leverage a content pack with defined alerts (you would still need to enable them though). As for resource mapping, that is user defined today, but see https://loginsight.vmware.com for suggestions on how to automatically handle this in a future release.

[wwandrei]

Thanks for suggestions ... that still means I need to enable same alert 18 times for each vCenter, a very useful function would be to be able to call a filter in LogInsight alarm definition (%filter%). Example: default vsphere alert vCenter Red Alert ... could be defined like this ": vCenter %source% triggered red alert  for %vmw_vc_alarm_type% that would be wonderful. Andrei

[sflanders]

Hmm, will what you are stating is possible, especially for email so perhaps you could use it for vC Ops as well. If you construct a query and then group by BOTH source and vmw_vc_alarm_type then create an alert using the last radio button for "Raise an alert" then with email you will notice that you get a table view where you can easily determine from which VC the alarm came from. In the case of vC Ops, you could trigger the same alarm to some global vC Ops object (e.g. World) and then send your SNMP trap. I believe this will provide the same functionality. Again, LI is looking to improve the functionality in a future release so stay tuned!

[wwandrei]

Thanks for reply! It`s fine for email but still for VCOPs the only  thing you get is the Alarm name (fixed string) and is raised as a notification event. If I could add the dynamic attribute (%field%) in alarm name it would help, otherweis I don`t see how. The notification event looks in vcops like this: Log  Insight found x events matching the criteria for alert "Loginsight defiled  alert  name". And this is identified as "description". While translating SNMP messages in VCO I can get and interpret: Description, Event Source, Object Name, time , Res Kind. The only thing that comes from loginsight is the description and that is alert name ... Maybe I`m missing something. Regards.

[sflanders]

Ah you are correct. Another workaround is to issue the SNMP trap from Log Insight. While the UI does not offer the ability to send a SNMP alert, the CLI does. User alerts are stored in /storage/var/loginsight/alerts.log and snmptrapd is installed on the VA. I will have a blog post on this soon, but would offer you another way to get what you need.