Couple Questions

[Tocano]

I've been delving into log insight recently and have a few questions:

1. If I create an alert, how can I make that available for others on my team to access and edit? (I'm hoping that it isn't silo'd like it seems.)
   • I'm not talking about as a dashboard item, but just an alert
   • I should be able to create an alert, and place it in a shared list that can be modified by others on my team
   • I assume this functionality is available, but I'm simply not finding it
2. Can I customize the text of email alerts and reference pieces of the events within them?
   • For example, if I create an alert, I'd like to be able to specify the text of the email alert like:
   • "In vCenter [[source]], host [[hostname]] ([[vmw_cluster]]) just reported a 'Problem' event: [[logline]]"
3. Can I send an alert notification to vRealize Orchestrator?
   • This seems to make sense as a method for reacting to trigger conditions in log insight, but I can't seem to figure out how to do this.

Log insight is a very impressive and hugely useful tool. Just a few things weren't quite straightforward to me.

Appreciate any guidance.

[admin]

If you are using Log Insight 4.0 then we now have a central user alert management. You need to have admin privileges to use it. You can then add multiple subscribers to the alert you created.

In general we cannot share alerts. You have to create a user 'shared' with a password you share with others and then create alerts as this shared user and add multiple subscribers to it.

2. Can I customize the text of email alerts and reference pieces of the events within them? - Yes you can Edit an alert , you will need to save it to user space and then Edit alert query , this will be visible to you only. You can enable a content pack alert without saving to your user space and then Edit alert query to tailor to your needs as well.

3. Can I send an alert notification to vRealize Orchestrator? - No you can't but we can send it to vRealize Operations Manager

Hope this helps.