Creating an alert using emailFilters.xml?

[MattG]

I configured the emailFilter.xml defaults to send to my email address and created and successfully tested an SMTP alert handler.

I cloned a Virtual Machine attribute package and modified the copy with the following settings for CPU Workload:

I applied this VM attribute to a VM and am using a utiliity on the VM to keep the CPU above 70%.   I can see an alert for the VM in the Custom UI alerts page.

I then modified the emailFilter.xml as follows:

<FilterRule name="VM01">

         <Conditions>

          <condition type="Virtual Machine">VM01</condition>

            <condition type="Level">Critical</condition>

          </Conditions>

        <Addresses>myemail@email.com</sendTo>

</Addresses>

      </FilterRule>

I saved the emailFilter.xml and restarted my SMTP alert handler,  however,  I am not receiving email alerts from the custom UI?

-MattG

[mark_j]

Your problem is here:

        <Addresses>myemail@email.com</sendTo>

You're missing the <sendTo type="email"> brackets.

[MattG]

I did have the email tag in the real XML:

<sendTo type="email">myemail@email.com</sendTo>

I accidentally removed it in the posting.

Any thoughts?

-MattG

[mark_j]

Your condition for the virtualmachine is incorrect.

ResourceKind Name of a resource kind in the format AdapterKind:ResourceKind.

For example: <condition type="ResourceKind">OPEN_API:DEMO</condition>

So you'd want something like this:

<condition type="ResourceKind">VirtualMachine:VM01</condition>

Try VirtualMachine with and without the space, I don't recall which is preferred in this case (I never alert on individual VMs).

[MattG]

Still not working.

-MattG

[TammieD]

You probably checked this, but just in case - is an alert being generated?  I don't have alerts set on an attribute package, just on a supermetric package. 

The supermetric package is assigned to an application, and I get alerts if either the dynamic threshold or the hard threshold are violated.  The application is assigned to a tag group; application name could be used, but I have multiple applications that alarm using the same rule, with different thresholds depending on the supermetric assigned.  And we delay the alerts because we don't want them if it is one data point and then goes away.

    <FilterRule name="KPI_Breach">

        <Conditions>

            <condition type="AlertType">Smart</condition>

            <condition type="AlertSubType">KPI_Breach</condition>

            <condition type="Status">New</condition>

            <condition type="Tag">Alarm Groups:App Alarms</condition>

        </Conditions>

        <Addresses>

            <sendTO delay="60" type="email">email@company.com</sendTO>

        </Addresses>

    </FilterRule>

    <FilterRule name="KPI_HT_Breach">

        <Conditions>

            <condition type="AlertType">Classic</condition>

            <condition type="AlertSubType">KPI_HT_Breach</condition>

            <condition type="Status">New</condition>

            <condition type="Level">Critical</condition>

            <condition type="Tag">Alarm Groups:App Alarms</condition>

        </Conditions>

        <Addresses>

            <sendTO delay="30" type="email">email@company.com</sendTO>

        </Addresses>

    </FilterRule>

[MattG]

Tammie,

Thanks for the info.

I am still trying to understand what a customvCopsapplication alert will look like?   I have an application named App1,  with a SuperMetric named SP1.   I want to create a DT alert when for SP1 on App1.    Does Smart = DT?   Does SP1 need to be a KPI?  If not what would it look like in the xml file?

Thanks,

-MattG

[TammieD]

Yes, Smart alerts are triggered by the Dynamic Threshold.  To get a Smart-KPI_Breach alert for the supermetric shown in the screenshot, the "violation of ..." box must be check (depending on whether above DT, below DT, or both is a concern).  I believe you would get a Smart Early warning alert instead of the Smart-KPI alert if you do not make it a KPI; we wanted out supermetrics to be KPIs, so I don't know for sure.  If you want to get an alert when a metric is exceeds a specific value ("hard threshold"), you would need to do the advanced configuration to set your thresholds.

The email generated for an alert will use the format specified in the emailFilters.xml as defined in the template.  At the top of the file, there is a templates section which defines the templates to use for each alert type, subtype, and status.  For an alert email to generate, you need to have both the template and the filter rule.  We chose not to get emails when an alert is canceled, so we have no filter rules for cancel.  I didn't include the filter rules, but we also get email for Administrative alerts and Smart Early Warning alerts (based on DT also, but for metrics which are not KPIs).

    <Templates>
        <Template alert_type="Administrative" alert_subtype="System" status="New">New-Administrative-System.html</Template>
        <Template alert_type="Administrative" alert_subtype="System" status="Cancel">Cancel-Administrative-System.html</Template>

        <Template alert_type="Classic" alert_subtype="KPI_HT_Breach" status="New">New-Classic-KPI_HT_Breach.html</Template>
        <Template alert_type="Classic" alert_subtype="KPI_HT_Breach" status="Cancel">Cancel-Classic-KPI_HT_Breach.html</Template>

        <Template alert_type="Smart" alert_subtype="EARLYWARNING" status="New">New-Smart-Earlywarning.html</Template>
        <Template alert_type="Smart" alert_subtype="EARLYWARNING" status="Cancel">Cancel-Smart-Earlywarning.html</Template>

        <Template alert_type="Smart" alert_subtype="KPI_Breach" status="New">New-Smart-KPI_Breach.html</Template>
        <Template alert_type="Smart" alert_subtype="KPI_Breach" status="Cancel">Cancel-Smart-KPI_Breach.html</Template>
    </Templates>

We could not get the custom templates to work, so we modifed the default templates to use the format we wanted (the .html template files are in the default_templates directory (user > plugins > outbound > filter_alertplugin > conf > default_templates).  You can use the delivered template or modify it to include what you want.  Our template "New-Smart-KPI_Breach.html" looks like this:

$$Subject=Alert:{{AlertId}} Rule:{{FilterRuleName}} Status:{{AlertStatus}} Resource:{{AffectedResourceName}}

<h4>Alert {{AlertId}} : {{AlertStatus}}-{{AlertType}}-{{AlertSubType}}-{{AlertCriticality}} : {{AffectedResourceName}}</h4>

Generated: {{AlertGenerateTime}}
Canceled: {{AlertCancelTime}}

<h2>Alert Details</h2>
Status: {{AlertStatus}}-{{AlertCriticality}}
Entity Name: {{AffectedResourceName}}
Entity Type: {{AffectedResourceKind}}
Alert ID: {{AlertId}}
Alert Message: {{AlertMessage}}

Alert Detail: {{AlertDetailLink}}

<h4>Trigger</h4>
{{AlertTrigger}}

<h4>Parent Health</h4>
{{ParentsHealth}}

<h4>Children Health</h4>
{{ChildrenHealth}}

<h4>Anomalies</H4>
{{Anomalies}}

<h2>***End Of Message***</h2>

Debug Template: ***New-Smart-KPI_Breach.html template in default_templates folder***
Debug Filter:   ***{{FilterRuleName}}***

The tags available are in the vCOps custom UI admin guide.