Creating Alert Definitions

To create or edit your alert definitions, from the left menu, click Configure > Alerts, and then in the right pane, click Alert Definitions.

Click Add to add a definition, or click the vertical ellipsis and select Edit to edit the selected definition.

In the Alert tab, enter details of the alert.


Option	Description
Name	Name of the alert as it appears when the alert is generated.
Description	Description of the alert as it appears when the alert is generated. Provide a useful description for your users.
Base Object Type	The object type against which the alert definition is evaluated and the alert is generated. The drop-down menu includes all of the object types in your environment. You can define an alert definition based on one object type.
Impact	Under Advanced Settings, select the badge that is affected if the alert is generated. You can select a badge based on the urgency of the alert. Health. Alert requires immediate attention. Risk. Alert should be addressed soon after it is triggered, either in days or weeks. Efficiency. Alert should be addressed in the long term to optimize your environment.
Criticality	Severity of the alert that is communicated as part of the alert notification. Select one of the following values. Info. Informational purposes only. Does not affect badge color. Warning. Lowest level. Displays yellow. Immediate. Medium level. Displays orange. Critical. Highest level. Displays red. Symptom Based. In addition to alert criticality, each symptom includes a defined criticality. Criticality of the alert is determined by the most critical of all of the triggered symptoms. The color is dynamically determined accordingly. It you negate symptoms, the negative symptoms to not contribute to the criticality of a symptom-based alert.
Alert Type and Subtype	Select the type and subtype of alert. This value is metadata that is used to classify the alert when it is generated, and the information is carried to the alert, including the alert notification. You can use the type and subtype information to route the alert to the appropriate personnel and department in your organization.
Wait Cycle	The symptoms included in the alert definition remain triggered for this number of collection cycles before the alert is generated. The value must be 1 or greater. This setting helps you adjust for sensitivity in your environment. The wait cycle for the alert definition is added to the wait cycle for the symptom definitions. In most definitions you configure the sensitivity at the level of symptom level and configure the wait cycle of alert definition to 1. This configuration ensures that after all of the symptoms are triggered at the desired symptom sensitivity level, the alert is immediately triggered.
Cancel Cycle	The symptoms are cancelled for this number of collection cycles after which the alert is cancelled. The value must be 1 or greater. This setting helps you adjust for sensitivity in your environment. The cancel cycle for the alert definition is added to the cancel cycle for the symptom definitions. In most definitions you configure the sensitivity at the level of symptom level and configure the wait cycle of the alert definition to 1. This configuration ensures that after all of the symptom conditions disappear after the desired symptom cancel cycle, the alert is immediately canceled.

Click Next to add symptom definitions.

In the Symptoms/Conditions, drag the selected symptom/condition in to the left pane. Use the workspace on the left to specify whether all or any of the symptoms/conditions or symptom/condition sets must be true to generate an alert. As you add one or more symptoms, you create a symptom expression. If this expression is evaluated as true, then the alert is generated. You can similarly define one or more conditions for your alert, and when the conditions are met, the alert is generated. You can view the alert in the All Alerts page.

Table 1. Add Symptoms/Conditions Selection Options
Option	Description
Defined On	Object that the symptom evaluates. As you create alert definitions, you can select or define symptoms for the base object type and for related object types, based on the object relationship hierarchy. The following relationships are object types as they relate to the alert definition base object type. Self. A base object type for the alert definition. For example, host system. Descendant. An object type that is at any level below the base object type, either a direct or indirect child object. For example, a virtual machine is a descendant of a host system. Ancestor. An object type that is one or more levels higher than the base object type, either a direct or indirect parent. For example, a data center and a vCenter Server are ancestors of a host system. Parent. An object type that is in an immediately higher level in the hierarchy from the base object type. For example, a data center is a parent of a host system. Child. An object type that is one level below the base object type. For example, a virtual machine is a child of a host system.
Symptoms tab
Select Symptom	Select the type of symptom definition that you are adding for the current Defined On object type. Metric / Property. Add symptoms that use metric and property symptoms. These metrics are based on the operational or performance values, and configuration properties that VMware Aria Operations collects from target objects in your environment. Message Event. Add symptoms that use message event symptoms. These symptoms are based on events received as messages from a component of VMware Aria Operations or from an external monitored system through the system's REST API. Fault Event. Add symptoms that use fault symptoms. These symptoms are based on events that monitored systems publish. VMware Aria Operations correlates a subset of these events and delivers them as faults. Faults are intended to signify events in the monitored systems that affect the availability of objects in your environment. Metric Event. Add symptoms that use metric event symptoms. These symptoms are based on events communicated from a monitored system where the selected metric violates a threshold in a specified manner. The external system manages the threshold, not VMware Aria Operations. These symptoms are based on conditions reported for selected metrics by an external monitored system, as compared to metric symptoms, which are based on thresholds that VMware Aria Operations is actively monitoring. Smart Early Warning. Add a symptom that uses a defined condition that is triggered when the number of anomalies on an object is over the trending threshold. This symptom represents the overall anomalous behavior of the object. Anomalies are based on VMware Aria Operations analysis of the number of applicable metrics that violate the dynamic threshold that determines the normal operating behavior of the object. This symptom is not configurable. You either use it or you do not use it.
Filter by Object Type	Available only when you select a Defined On value other than Self. Limits the symptoms to those that are configured for the selected object type based on the selected Defined On relationship.
Create New Symptom	If symptoms that you need for your alert do not exist, you can create them. Opens the symptoms definition dialog box. Not available for Smart Early Warning symptoms, which are predefined in the system.
All Filters	Filter the list of symptom definitions. This selection is available when Defined On is set to Self, or when it is set to another relationship and you select an object from the Filter by Object Type drop-down menu. Symptom. Type text to search on the name of the symptom definitions. For example, to display all symptom definitions that have efficiency in their name, type `Efficiency`. Defined By. Type text to search for the name of the adapter that defines the symptom definitions. For example, to display all symptom definitions provided by the vCenter Adapter, type `vCenter`. To display only user-defined symptom definitions, type the search term `User`. To clear a filter, click the double arrow icon that appears next to the filter name.
Quick filter (Name)	Search the list based on the symptom name.
Symptoms list	List of existing symptoms for the selected object type. To configure a symptom, drag it into the left workspace. To combine symptoms that are based on multiple levels in the hierarchy, select the new Defined On level and Filter by Object Type before you select and drag the new symptom to the workspace.
Conditions tab
Select Specific Object	Select a specific object based on its object type, adapter type, policy, collection state, and status.
Filter	Search the metrics based on object type.
Conditions list	List of metrics for the selected object type. To configure a condition, drag it into the left workspace.

Use the workspace to configure the interaction of the symptoms, symptom sets, and conditions.

Table 2. Symptom Sets in the Alert Definition Workspace
Option	Description
Trigger alert when {operator} of the symptom sets are true	Select the operator for all of the added symptom/condition sets. Available only when you add more than one symptom/condition set. All. All of the symptom/condition sets must be true before the alert is generated. Operates as a Boolean AND. Any. One or more of the symptom/condition sets must be true before the alert is generated. Operates as a Boolean OR.
Symptoms	The symptom/condition sets comprise an expression that is evaluated to determine if an alert should be triggered. To add one or more symptoms from the symptom list to an existing symptom set, drag the symptom from the list to the symptom set. To create a new symptom set for the alert definition, drag a symptom to the landing area outlined with a dotted line.
Symptom sets	Add one or more symptoms to the workspace, define the points at which the symptom sets are true, and specify whether all or any of the symptoms in the symptom set must be true to generate the alert. A symptom set can include one or more symptoms/conditions, and an alert definition can include one or more symptom/condition sets. If you create a symptom set where the Defined On object is Self, you can set the operator for multiple symptoms in the symptom set. If you create a symptom set where the Defined On object is a relationship other than Self, you can set the operator and modify the triggering threshold. To configure the symptom set criteria, you set the options. Value operator. Specifies how the value you provide in the value text box is compared to a number of related objects to evaluate the symptom/condition set as true. Value text box. Number of objects of the specified relationship, based on the value type, that are required to evaluate the symptom/condition set as true. Value type. Possible types include the following items: Count. Exact number of related objects meet the symptom/condition set criteria. Percent. Percentage of total related objects meet the symptom/condition set criteria. Any. One or more of the related objects meet the symptom/condition set criteria. All. All of the related objects meet the symptom/condition set criteria. Symptom set operator. Operator applied between symptoms/conditions in the symptom set. All. All of the symptoms/conditions must be true before the alert is generated. Operates as a Boolean AND. Any. One or more of the symptoms/condition must be true before the alert is generated. Operates as a Boolean OR. When you include a symptom in a symptom set, the condition must become true to trigger the symptom set. However, you might want to configure a symptom set where the absence of a symptom condition triggers a symptom. To use the absence of the symptom condition, click the vertical ellipsis on the left of the symptom name and select Invert Symptom. Although you can configure symptom criticality, if you invert a symptom, it does not have an associated criticality that affects the criticality of generated alerts.

Table 3. Conditions in the Alert Definition Workspace
Option	Description
Alert is triggered when {operator} of the sets are true	Select the operator for all of the added condition sets. Available only when you add more than one condition set. All. All of the condition sets must be true before the alert is generated. Operates as a Boolean AND. Any. One or more of the condition sets must be true before the alert is generated. Operates as a Boolean OR.
Conditions	The condition sets comprise an expression that is evaluated to determine if an alert should be triggered. Condition. Determines how the value you specify in the value text box is compared to the current value of the metric or property when the condition is evaluated. Value. Value that specifies the threshold. Criticality level. Severity of the symptom/condition when it is triggered. Wait Cycle. The trigger condition should remain true for this number of collection cycles before the symptom/condition is triggered. The default value is 1, which means that the symptom/condition is triggered in the same collection cycle when the condition became true. Note: You cannot edit the wait cycle while defining conditions for Properties and Population. Cancel Cycle. The symptom/condition is canceled after the trigger condition is false for this number of collection cycles after which the symptom/condition is cancelled. The default value is 1, which means that the symptom/condition is canceled in the same cycle when the condition becomes false. Note: You cannot edit the cancel cycle while defining conditions for Properties and Population. To add one or more conditions from the condition list to an existing symptom/condition set, drag the condition from the list to the symptom/condition set.

Click Next to add recommendations.

In the Recommendations tab, drag the selected recommendation in to the left pane. Use the workspace on the left to to change the priority order.

Table 4. Add Recommendations Options in the Alert Definition Workspace

Create New Recommendation	If recommendations that you need to resolve the symptoms in the problem do not exist, you can create them.
All Filters	Filter the list of recommendations. Description. Type text to search on the name of the recommendation. For example, to display all recommendations that have memory in their name, type `Memory`. Defined By. Type text to search for the name of the adapter that defines the recommendation. For example, to display all recommendations provided by the vCenter Adapter, type `vCenter`. To clear a filter, click the double arrow icon that appears next to the filter name.
Quick filter (Name)	Limits the list based on the text you enter.
List of available recommendations.	List of existing recommendations that you can drag to the workspace. Recommendations are instructions and, where possible, actions that assist you with resolving alerts when they are triggered.
Recommendation workspace	Add one or more recommendations to the workspace. If you add more than one recommendation, you can drag the recommendations to change the priority order.

Click Next to activate policies.

In the Policies tab, you can view the policy tree in the left pane and you can either select the default policy or any other policy from the tree.

You can automate the recommended action that has the highest priority by changing the Status to Activated in the right pane. Whenever the alert is executed on an object within the policy, the recommended action will be executed on the object.

Note: To deactivate alerts associated with a specific policy, deselect the policy in the left pane, and click Update.

You can also customize thresholds for a policy by clicking the policy and editing the trigger value in the right pane. Editing the threshold of conditions will affect its alert definition in the selected policy.

Note: If you create an alert without enabling any policies, then the alert remains inactive.

Click Create to create the alert. The new alert appears in the list of alert definitions.