Defining Symptoms for Alerts

The symptoms defined in your environment are managed in the Symptom Definitions page.

You can create a symptom definition while creating an alert definition or as an individual item from the Symptom Definitions page.

You can define symptoms based on:

Metric/Property Symptoms

Metric/Property symptoms are based on the operational/performance values or the configuration properties that VMware Aria Operations collects from target objects in your environment.

Metric Symptom Definitions

You can configure the symptoms to evaluate static thresholds or dynamic thresholds. You define symptoms based on metrics so that you can create alert definitions that let you know when the performance of an object in your environment is adversely affected.

Static Thresholds

Metric symptoms that are based on a static threshold compare the currently collected metric value against the fixed value you configure in the symptom definition.

For example, you can configure a static metric symptom where, when the virtual machine CPU workload is greater than 90, a critical symptom is triggered.

Dynamic Thresholds

Metric symptoms that are based on dynamic thresholds compare the currently collected metric value against the trend identified by VMware Aria Operations, evaluating whether the current value is above, below, or generally outside the trend.

For example, you can configure a dynamic metric symptom where, when the virtual machine CPU workload is above the trended normal value, a critical symptom is triggered.

The Metric Symptom Definitions is a list of the metric-based symptoms defined in your VMware Aria Operations environment. You use the information in the list to evaluate the defined metric threshold triggering states and determine if you want to add, edit, or clone symptoms.

Property Symptom Definitions

You define symptoms based on properties so that you can create alert definitions that let you know when changes to properties on your monitored objects can affect the behavior of the objects in your environment.

The Property Symptom Definitions is a list of the property-based symptoms in your VMware Aria Operations environment. You use the information in the list to evaluate the defined property triggering states and determine whether to add, edit, or clone symptoms.

Where You Find Metric/Property Symptoms

To manage symptoms based on metrics/properties, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions > Metric / Property.

You can also define symptoms as you are defining alerts in the Alert Definition Workspace.

Table 1. Metric/Property Symptoms Options
Option	Description
Toolbar options	Use the toolbar options to manage your symptoms. You can select multiple symptoms using Ctrl+click or Shift+click. Add. Add a symptom definition. Click the horizontal ellipsis to perform the following actions. Edit. Modify the selected symptom definition. Any changes you make affect the alert definitions that include this symptom. You cannot edit a symptom that manages a badge. Delete. Remove the selected symptom definition. You cannot delete an alert that is used in an alert definition. To delete a symptom, you must first remove it from the alert definitions in which it is used. You cannot delete a symptom that manages a badge. Clone. Create a copy of the selected symptom definition. Export. Downloads the symptom definition. Import. Allows you to import symptom definitions. To import: Click the Import option from the horizontal ellipsis. Click Browse and select the file to import. Select if you want to Overwrite or Skip the file in case of a conflict. Click Import to import the symptom definition, and click Done.
Filter options	Limits the list based on the text you type. You can also sort on the columns in the data grid.
Name	Descriptive name of the symptom.
Criticality	Severity of the symptom when it is triggered.
Object Type	Base object type against which the symptom is defined.
Metric Name	Text string that is used as a reference key for the metric. You can use the metric key to locate additional information about how the system statistics are derived from the metric.
Operator	Operator used to compare the current value to the threshold value, and trigger the symptom.
Value	Text string that is the compared value for the property.
Defined By	Indicates whether the symptom was created by a user or provided with a solution adapter.
Last Modified	Displays the date on which the symptom was last modified.
Modified By	Displays the name of the user who last modified the symptom.

Defining Metric/Property Symptoms

A metric symptom is triggered when a metric is compared to the configured static or dynamic thresholds, and the symptom condition is evaluated as true in VMware Aria Operations.

Defining Metric Symptoms

If the symptom is based on a static threshold, the metric is compared based on the configured operator and the provided numeric value. If the symptom is based on a dynamic threshold, the metric is compared based on whether the current value is above, below, or abnormal compared to the calculated trend value.

To define symptoms based on metrics, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions > Metric / Property. Click Add to define a metric-based symptom in the workspace.

Enter the following details.


Option	Description
Base Object Type	Object against which the symptom is evaluated. Based on the select object type, the list of available metrics displays only the metrics applicable to the object type.
Symptom Type	Select Metrics from the Symptom Type drop-down list.
Select Specific Object	If a metric or supermetric is not listed in the common metric or supermetric list, based on the selected based object type, use Select Object to inspect the metrics or supermetrics of a selected object so that you can locate the property that you must use to create the symptom. Even though you select a metric or supermetric for a specific object, the symptom definition is applicable to all objects with that metric or supermetric in your environment.
Search	Use a word search to limit the number of items that appear in the list.
Metric list	List of metrics for the selected base object type. Click and drag the metric to the left pane.
Symptom Definition workspace You can define symptoms based on static or dynamic thresholds.
Threshold	Determines if the symptom is static or dynamic. Static thresholds are fixed values that trigger symptoms as true. You can configure one threshold for each symptom. You can also create multiple symptoms for multiple thresholds. For example, configure one symptom where the CPU use is greater than 90 percent and another where the CPU usage is less than 40 percent. Each is a separate symptom and can be added individually to an alert definition. Dynamic thresholds are based on VMware Aria Operations trended data where the triggering value is determined through the analytics. If the current value of the metric does not fall in the trended range, the symptom is triggered.
Static Threshold configuration options	If you select Static Threshold, configure the options for this threshold type. Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms. Condition. Determines how the value you specify in the value text box is compared to the current value of the metric when the symptom is evaluated. Value. Value that the condition evaluates. Criticality. Severity of the symptom when it is triggered. Wait Cycle. The trigger condition should remain true for this number of collection cycles before the symptom is triggered. The default value is 1, which means that the symptom is triggered in the same collection cycle when the condition became true. Cancel Cycle. The symptom is canceled after the trigger condition is false for this number of collection cycles after which the symptom is cancelled. The default value is 1, which means that the symptom is canceled in the same cycle when the condition becomes false. Evaluate on instanced metrics. Select this check box so that the system evaluates the object level symptom as well as the instance level symptom. For example, for CPU usage, when the check box is not selected, the symptom is triggered based on the object's CPU usage. However, if you select the check box, the system also evaluates CPU usage of each of the cores. If any of the cores is found to be crossing the threshold, the symptom is triggered. Exclude the following instances of the metric. To exclude specific instanced metrics from the symptom, drag the metric instances from the left pane. If you cannot locate the metric instance you want to exclude, you can search for it in another object that uses the metric by clicking Select Specific Object next to the search box. To enable the metric threshold evaluation based on real-time data collected every 20 seconds, click the Near Real-Time Monitoring check box. Note: If alerts have symptom definitions with near real-time monitoring enabled, the alerts will be triggered based on the 20 seconds cycle instead of five minutes. The near real-time data collection should be enabled through all cloud accounts. This setting can be controlled through symptom overrides in policies.
Dynamic Threshold configuration options	If you select Dynamic Threshold, configure the options for this threshold type. Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms. Condition. Relationship of the current value to trended range based on the following options: Above Threshold. If current value is above trended range, the symptom is triggered. Below Threshold. If the current value is below the trended range, the symptom is triggered. Abnormal. If the current value is either above or below the trended range, the symptom is triggered. Criticality. Severity of the symptom when it is triggered. Evaluate on instanced metrics. Select this check box so that the system evaluates the object level symptom as well as the instance level symptom. For example, for CPU usage, when the check box is not selected, the symptom is triggered based on the object's CPU usage. However, if you select the check box, the system also evaluates CPU usage of each of the cores. If any of the cores is found to be crossing the threshold, the symptom is triggered. Exclude the following instances of the metric. To exclude specific instanced metrics from the symptom, drag the metric instances from the left pane. If you cannot locate the metric instance you want to exclude, you can search for it in another object that uses the metric by clicking Select Object next to the Metrics field.

Click Save.

Defining Property Symptom

A property symptom is triggered when the defined threshold is compared with the current property value and the comparison is evaluated as true.

To define symptoms based on properties, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions > Metric / Property. Click Add to define a property-based symptom in the workspace.

Enter the following details.


Option	Description
Base Object Type	Object against which the symptom is evaluated. Based on the selected object type, the list of available properties displays only the properties applicable to the object type.
Symptom Type	Select Properties from the Symptom Type drop-down list.
Select Specific Object	If a property is not listed in the common properties list, based on the selected based object type, use Select Object to inspect the properties of a selected object so that you can locate the property that you must use to create the symptom. Even though you select a property for a specific object, the symptom definition is applicable to all objects with that property in your environment.
Search	Use a word search to limit the number of items that appear in the list.
Property list	List of properties for the selected base object type. Click and drag the property to the left pane.
Symptom Definition workspace The properties are configured values that are compared to the value you specify. You can configure a single property symptom or add multiple symptoms. For example, if you need an alert when a particular property, such as Memory Hot Add, is no longer at the value required, you can configure a symptom and add it to an alert definition.
Property	Configure the options: Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms. Condition. Determines how the value you specify in the value text box is compared to the current value of the property for an object when the symptom definition is evaluated. Value. Value that the condition evaluates. Criticality. Severity of the symptom when it is triggered. Wait Cycle. The trigger condition should remain true for this number of collection cycles before the symptom is triggered. The default value is 1, which means that the symptom is triggered in the same collection cycle when the condition became true. Cancel Cycle. The symptom is canceled after the trigger condition is false for this number of collection cycles after which the symptom is cancelled. The default value is 1, which means that the symptom is canceled in the same cycle when the condition becomes false. Evaluate on instanced properties. Select this check box so that the system evaluates the object level symptom as well as the instance level symptom. For example, for memory usage, when the check box is not selected, the symptom is triggered based on the object's memory usage. However, if you select the check box, the system also evaluates memory usage of each of the cores. If any of the cores is found to be crossing the threshold, the symptom is triggered. Drop instances to exclude. To exclude specific instanced properties from the symptom, drag the property instances from the right pane. If you cannot locate the property instance you want to exclude, you can search for it in another object that uses the property by clicking Select Specific Object next to the search box.

Click Save.

Message Event Symptoms

Message event symptoms are based on events received as messages from a component of VMware Aria Operations or from an external monitored system through the system's REST API. You define symptoms based on message events to include in alert definitions that use these symptoms. When the configured symptom condition is true, the symptom is triggered.

The adapters for the external monitored systems and the REST API are inbound channels for collecting events from external sources. Adapters and the REST server both run in the VMware Aria Operations system. The external system sends the messages, and VMware Aria Operations collects them.

You can create message event symptoms for the supported event types. The following list is of supported event types with example events.

System Performance Degradation. This message event type corresponds to the EVENT_CLASS_SYSTEM and EVENT_SUBCLASS_PERFORM_DEGRADATION type and subtype in the VMware Aria Operations API SDK.
Change. The VMware adapter sends a change event when the CPU limit for a virtual machine is changed from unlimited to 2 GHz. You can create a symptom to detect CPU contention issues as a result of this configuration change. This message event type corresponds to the EVENT_CLASS_CHANGE and EVENT_SUBCLASS_CHANGE type and subtype in the VMware Aria Operations API SDK.
Environment Down. The VMware Aria Operations adapter sends an environment down event when the collector component is not communicating with the other components. You can create a symptom that is used for internal health monitoring. This message event type corresponds to the EVENT_CLASS_ENVIRONMENT and EVENT_SUBCLASS_DOWN type and subtype in the VMware Aria Operations API SDK.
Notification. This message event type corresponds to the EVENT_CLASS_NOTIFICATION and EVENT_SUBCLASS_EXTEVENT type and subtype in the VMware Aria Operations API SDK.

Where You Find Message Event Symptoms

To manage symptoms based on message events, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions. Select the Message Event tab.

You can also define symptoms as you are defining alerts in the Alert Definition Workspace.

The Message Event Symptom Definitions is a list of the message event-based symptoms defined in your VMware Aria Operations environment. You use the information in the list to evaluate the defined message events and to determine if you want to add, edit, or clone symptoms.


Option	Description
Toolbar options	Use the toolbar options to manage your symptoms. You can select multiple symptoms using Ctrl+click or Shift+click. Add. Add a symptom definition. Click the horizontal ellipsis to perform the following actions. Edit. Modify the selected symptom definition. Any changes you make affect the alert definitions that include this symptom. You cannot edit a symptom that manages a badge. Delete. Remove the selected symptom definition. You cannot delete an alert that is used in an alert definition. To delete a symptom, you must first remove it from the alert definitions in which it is used. You cannot delete a symptom that manages a badge. Clone. Create a copy of the selected symptom definition. Export and Import. Export the file as xml from one VMware Aria Operations so that you can import the file on another instance. When you import the file, if you encounter a conflict, you can override the existing file or not import the new file.
Filter options	Limits the list based on the text you type. You can also sort on the columns in the data grid.
Name	Descriptive name of the symptom.
Adapter Type	Adapter type for which the symptom is configured.
Object Type	Base object type against which the symptom is defined.
Event Type	Defined event classification type.
Operator	Operator used to compare the message from the incoming event against the event message specified in the symptom.
Event Message	Text string that is compared to the message in the incoming event using the specified operator.
Criticality	Severity of the symptom when it is triggered.
Defined By	Indicates whether the symptom was created by a user or provided with a solution adapter.
Last Modified	Displays the date on which the symptom was last modified.
Modified By	Displays the name of the user who last modified the symptom.

Defining Message Events

You can define message event systems in VMware Aria Operations so that you can create one or more of the symptoms that you can add to an alert definition. A message event symptom is triggered when a message in an incoming event matches the text string in the symptom, based on the specified operator.

To define symptoms based on message events, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions.
Select the Message Event tab, and then click Add.
Note:
Near Real-Time Monitoring is triggered automatically if the adapter instance has real-time monitoring enabled.

Enter the following details.

Table 2. Symptoms Workspace Options for Message Events
Option	Description
Based Object Type	Object against which the symptom is evaluated.
Symptom Type	Displays the symptom type as Message Event.
Select the Type of Event	Select the type of incoming event against which you are matching the events as they arrive. The incoming event must contain the following type and subtype combinations. System Degradation Change Environment Notification Data Availability Collector Down Object Error Click and drag the message event to the left pane.
Symptom Definition workspace The Message Event text string is compared to the message in the incoming event by using the specified operator. You can configure a single message event symptom or add multiple symptoms. For example, the VMware adapter sends a change event when the CPU limit for a virtual machine was changed from unlimited to 2 GHz. You can create a symptom to detect CPU contention issues as a result of this configuration change.
Message Event	Configure the options: Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms. Condition. Determines how the value you specify in the value text box is compared to the current value of the property for an object when the symptom definition is evaluated. Value. Value that the condition evaluates. Criticality. Severity of the symptom when it is triggered.

Click Save.

Fault Symptoms

Fault symptoms are based on events published by monitored systems. VMware Aria Operations correlates a subset of these events and delivers them as faults. Faults are intended to signify events in the monitored systems that affect the availability of objects in your environment. You define symptoms based on faults to include in alert definitions that use these symptoms. When the configured symptom condition is true, the symptom is triggered.

You can create fault symptoms for the supported published faults. Some object types have multiple fault definitions from which to choose, while others have no fault definitions.

If the adapter published fault definitions for an object type, you can select one or more fault events for a given fault while you define the symptom. The symptom is triggered if the fault is active because of any of the chosen events. If you do not select a fault event, the symptom is triggered if the fault is active because of a fault event.

Where You Find Fault Symptoms

To manage symptoms based on fault message events, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions. Select the Fault tab.

You can also define symptoms as you are defining alerts in the Alert Definition Workspace.

The Fault Symptom Definitions is a list of the fault-based symptoms defined in your VMware Aria Operations environment. You use the information in the list to evaluate the defined fault message events and to determine whether to add, edit, or clone symptoms.


Option	Description
Toolbar options	Use the toolbar options to manage your symptoms. You can select multiple symptoms using Ctrl+click or Shift+click. Add. Add a symptom definition. Click the horizontal ellipsis to perform the following actions. Edit. Modify the selected symptom definition. Any changes you make affect the alert definitions that include this symptom. You cannot edit a symptom that manages a badge. Delete. Remove the selected symptom definition. You cannot delete an alert that is used in an alert definition. To delete a symptom, you must first remove it from the alert definitions in which it is used. You cannot delete a symptom that manages a badge. Clone. Create a copy of the selected symptom definition. Export and Import. Export the file as xml from one VMware Aria Operations so that you can import the file on another instance. When you import the file, if you encounter a conflict, you can override the existing file or not import the new file.
Filter options	Limits the list based on the text you type. You can also sort on the columns in the data grid.
Name	Descriptive name of the symptom.
Adapter Type	Adapter type for which the symptom is configured.
Object Type	Base object type against which the symptom is defined.
Fault	Selected fault based on object type.
Defined By	Indicates whether the symptom was created by a user or provided with a solution adapter.
Last Modified	Displays the date on which the symptom was last modified.
Modified By	Displays the name of the user who last modified the symptom.

Defining Fault Symptoms

You can define fault symptoms in VMware Aria Operations that are based on events published by the monitored systems, so that you can add one or more symptoms to an alert definition. A fault symptom is triggered when a fault is active on the base object because of the occurrence of any of the fault events selected in the symptom definition.

To define symptoms based on fault message events, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions.
Select the Fault tab and then, click Add.

Enter the following details.


Option	Description
Based Object Type	Object against which the symptom is evaluated.
Symptom Type	Displays the symptom type as Fault.
Fault Definitions	Select the fault definition for the selected base object type. Some object types do not have fault definitions, and other types have multiple definitions. Click and drag the fault definition to the left pane.
Symptom Definition workspace The fault events are published events from monitored systems. You can configure a single fault event symptom or add multiple symptoms. For example, if your base object is host and you drag the Hardware sensor fault for unknown type fault definition, you then select one of two text strings indicating a fault.
Fault Symptom	Configure the options: Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms. Value. Select one or more fault events that activate the fault. If you do not select a string, then any of the provided strings are evaluated. Criticality. Severity of the symptom when it is triggered.

Click Save.

Metric Event Symptoms

Metric event symptoms are based on events communicated from a monitored system where the selected metric violates a threshold in a specified manner. The external system manages the threshold, not VMware Aria Operations.

Metric event symptoms are based on conditions reported for selected metrics by an external monitored system, as compared to metric symptoms, which are based on thresholds that VMware Aria Operations is actively monitoring.

The metric event thresholds, which determine whether the metric is above, below, equal to, or not equal to the threshold set on the monitored system, represent the type and subtype combination that is specified in the incoming metric event.

Above Threshold. Corresponds to type and subtype constants EVENT_CLASS_HT and EVENT_SUBCLASS_ABOVE defined in the VMware Aria Operations API SDK.
Below Threshold. Corresponds to type and subtype constants EVENT_CLASS_HT and EVENT_SUBCLASS_BELOW defined in the VMware Aria Operations API SDK.
Equal Threshold. Corresponds to type and subtype constants EVENT_CLASS_HT and EVENT_SUBCLASS_EQUAL defined in the VMware Aria Operations API SDK.
Not Equal Threshold. Corresponds to type and subtype constants EVENT_CLASS_HT and EVENT_SUBCLASS_NOT_EQUAL defined in the VMware Aria Operations API SDK.

Where You Find Metric Event Symptoms

To manage symptoms based on metric events, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions. Click the Metric Event tab.

You can also define symptoms as you are defining alerts in the Alert Definition Workspace.

The Metric Event Symptom Definitions is a list of the metric event-based symptoms defined in your VMware Aria Operations environment. You use the information in the list to evaluate the defined threshold triggering states for the metric events and to determine if you want to add, edit, or clone symptoms.


Option	Description
Toolbar options	Use the toolbar options to manage your symptoms. You can select multiple symptoms using Ctrl+click or Shift+click. Add. Add a symptom definition. Click the horizontal ellipsis to perform the following actions. Edit. Modify the selected symptom definition. Any changes you make affect the alert definitions that include this symptom. You cannot edit a symptom that manages a badge. Delete. Remove the selected symptom definition. You cannot delete an alert that is used in an alert definition. To delete a symptom, you must first remove it from the alert definitions in which it is used. You cannot delete a symptom that manages a badge. Clone. Create a copy of the selected symptom definition. Export and Import. Export the file as xml from one VMware Aria Operations so that you can import the file on another instance. When you import the file, if you encounter a conflict, you can override the existing file or not import the new file.
Filter options	Limits the list based on the text you type. You can also sort on the columns in the data grid.
Name	Descriptive name of the symptom.
Adapter Type	Adapter type for which the symptom is configured.
Object Type	Base object type against which the symptom is defined.
Event Metric	Selected event metric based on object type.
Event Type	Specifies whether the metric was above, below, equal to, or not equal to the threshold set by the monitoring system.
Defined By	Indicates whether the symptom was created by a user or provided with a solution adapter.
Last Modified	Displays the date on which the symptom was last modified.
Modified By	Displays the name of the user who last modified the symptom.

Defining Metric Event Symptoms

You can define metric event symptoms that are based on reported violations of metric thresholds from monitored systems, so that you can create one or more of the symptoms that you can add to an alert definition in VMware Aria Operations.

To define symptoms based on metric events, from the left menu, click Configure > Alerts, and then in the right pane, click Symptom Definitions.
Select the Metric Event tab and then, click Add.

Enter the following details.


Option	Description
Base Object Type	Select the base object type. Object against which the symptom is evaluated. Based on the select object type, the list of available metrics displays only the metrics applicable to the object type.
Symptom Type	Displays the symptom type as Metric Event.
Search	Use a word search to limit the number of items that appear in the list.
Select Specific Object	If a metric or supermetric is not listed in the common metric or supermetric list, based on the selected based object type, use Select Object to inspect the metrics or supermetrics of a selected object so that you can locate the property that you must use to create the symptom. Even though you select a metric or supermetric for a specific object, the symptom definition is applicable to all objects with that metric or supermetric in your environment.
Metric Event list	Select the metric event for the selected base object type. Click and drag the metric to the left pane.
Symptom Definition Workspace You can configure a single threshold or add multiple thresholds. For example, configure a symptom where, when the virtual machine CPU usage is above the threshold defined in the monitored system, the metric event is above the threshold on the system.
Metric Event	Configure the options: Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms. Condition. Select whether the metric is above, below, equal to, or not equal to the threshold set on the monitored system. Criticality. Severity of the symptom when it is triggered. Click Save.

Click Save.