1 person found this helpful
You may want to change your alert definition so that it is created on the object type of Virtual Machine (to reflect the hostname) and not Windows Service.
Your symptoms may be to be adjusted as well. Something like this:
Symptoms Descendant-Windows Service
This symptom set is true when: any of descendant windows service objects exhibit all of the following symptoms.
1. Win Service display name "VMware Tools Windows Service is acting abnormally"
2. Win Service in not available
mghall This has worked like a charm, Thank you!!
New alert was generated at Fri Jul 13 13:18:54 UTC 2018:
Info:MT-AUDIT01 VirtualMachine is acting abnormally since Fri Jul 13 13:18:54 UTC 2018 and was last updated at Fri Jul 13 13:18:54 UTC 2018
Alert Definition Name: _Windows Service Unavailable
Alert Definition Description: Alert showing the server name of the unavailable service
Object Name : MT-AUDIT01
Object Type : VirtualMachine
Alert Impact: health
Alert State : critical
Alert Type : Application
Alert Sub-Type : Availability
Object Health State: critical
Object Risk State: info
Object Efficiency State: info
Control State: Open
SYMPTOM SET - descent
_Windows Service Availability
- 0.0 < 100.0
Did you change the Alert definition or created a new one? I am having the same issue and not about to resort to appending the hostname to each Windows Service. Basically just trying to find out what you did as this looks like it would work for us.
You should be able to change the alert definiation, depending on how you're doing the defination. Edit the alert definiation and try changing the Base Object Type from Windows Service to Virtual Machine.
The symptom set should be true when Any descendant windows servce objects equal ALL of the symptoms.
For the Symptoms, you'll want to have one be the Win Service display name equal to your service. The other symptom should be Win Service not available.
Hope that helps.
OK, yea i was trying to see if i could edit the alert definition "object not available" but it says its applied to all adapters so i cannot edit it. Which one did you edit?
Indeed these cannot be edited.
I've created two symptoms and put them in a new alert definition.
I was wondering if you need create a set (two symptoms and one alert definition) for each service you want to monitor or can you group all the services you want in one set (multiple symptoms. depends on how many services and one alert definition)?