You can change the trigger conditions for an alert, activate or deactivate alert notifications, or change the alert notification method (email, webhook, or send to VMware Aria Operations).


If your user account is assigned a role with full access for content packs and alerts, you can activate a content pack alert and modify its notifications. However, you cannot update or remove the content pack alert.


  • Verify that you are logged in to the VMware Aria Operations for Logs web user interface, for which the URL format is https://operations_for_logs-host. Here, operations_for_logs-host is the IP address or host name of the VMware Aria Operations for Logs virtual appliance.
  • Verify that your user account is associated with a role that has the relevant permissions for alerts.

    If your user account is assigned a role with view access to alerts (for example, the User role), you can view and manage all the alerts in your organization.

    If your user account is assigned a role with edit or full access to alerts (for example, the Super Admin role):
    • You can activate or deactivate all the system alerts in your organization.
    • You can create, modify, and remove all the user-defined alerts in your organization.
    For information about roles, see Create and Modify Roles in Administering VMware Aria Operations for Logs.
Also, verify the following for email, webhook, and VMware Aria Operations notifications:


  1. Expand the main menu and navigate to Alerts > Alerts Definition.
  2. Locate the alert that you want to modify. You can search for the alert by entering keywords in the search text box or by using the sort or filter functionalities.
  3. Click the three dots icon against the alert and click Edit.
  4. Modify the alert as required.
    Note: If you clear all the notification options, the alert is deactivated.
  5. Click Save.