Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
 
Search the VMware Knowledge Base (KB)   View by Article ID
 

Configuring multi-level alert rules in vCenter Operations Manager Enterprise (2021314)

Details

You can configure complex alert rules that evaluate multiple conditions on related resources in vCenter Operations Manager Enterprise. For example, you can write a multi-level rule that generates an alert if the workload on a virtual machine exceeds A for B cycles and health is below C and the host's CPU usage is above DT.
 
Because the HT conditions in multi-level alert rules do not generate additional alerts, this feature reduces the number alerts and lets you focus only on important alerts.

Solution

To enable multi-level alert rules, add rules to the vcenter-ops/user/conf/analytics/multi-level-alert-rules.xml file, where vcenter-ops is the path to the installation folder, for example, /usr/lib/vmware-vcops. In a vApp installation, the file is on the Analytics virtual machine.You must restart the Analytics service after editing the file for your changes to take effect.
 
A commented example is included in the file that describes the rule structure. For example:
 
<rules>
<!-- example rule with nested conditions and dynamic threshold
<rule alert="VirtualMachine" attributeKey="System Attributes|health" criticality="critical">
<cond operator="and">
<cond type="ht" operator="&lt;=" cancelCycles="5" waitCycles="3">
<token resourceKind="VirtualMachine" attributeKey="System Attributes|health" />
<value>100</value>
</cond>
<cond operator="and">
<cond type="ht" operator="&gt;" cancelCycles="5" waitCycles="3">
<token resourceKind="HostSystem" attributeKey="summary|workload" />
<value>0</value>
</cond>
<cond type="dt" operator="below">
<token resourceKind="VirtualMachine" attributeKey="cpu|usage_average" />
</cond>
</cond>
</cond>
</rule>
-->
</rules>
 
The following table describes the rule attributes.
 
Attribute Description
alert Specifies the resource kind on which the alert is defined. vCenter Operations Manager Enterprise checks all resources of the specified resource kind if the resource, or its parents, satisfy the rules. For example, the rule
VirtualMachine cpu_usage > 50 AND HostSystem cpu_usage > 50 defines an alert on VirtualMachine. If you define the same rule on HostSystem, the rule does not work.
attributeKey You can retrieve attribute keys from the database.
criticality Valid values are critical, immediate, info, none, and warning.
 
The following table describes the cond attributes.
 
Attribute Description
operator Valid values are and and or. You can nest operators.
type Valid values are ht for hard threshold and dt for dynamic threshold. Operators for ht are >, >=, <=, =, and !=. You must escape operators in the XML, for example, < is &lt. dt operators are above, below, and abnormal.
 
There is no specific alert type for multi-level alerts. Instead, the user interface displays multi-level alerts as KPI HT alerts, but the alert description identifies the alert as a Multi Level Rule. Rule details and triggers appear in the Reason pane on the Alert Details page. Multi-level alerts are also visible as KP HT Breach in the mashup chart for the alert and the INFO field shows the rule details.
To disable multi-level alert rules, replace the alert-rules.xml file with an empty file and restart the Analytics service.

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 1 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)
  • 1 Ratings
Actions
KB: