From the System Status page of the SDDC Manager client, you can work with the alerts, events, and audit events that have been reported by your Cloud Foundation environment.

On the System Status page, you can see the total count of alerts, events, and audit events at a glance, and then use the View Details links to drill-down for details about each type.

The vRealize Log Insight instance that SDDC Manager deploys is the final destination for all events. SDDC Manager maintains 1000 events in its local database. Once those events have been forwarded to vRealize Log Insight, the locally stored events are deleted. The locally stored events are deleted when the event count reaches a system-default upper limit of 80% of 1000, or 800 events. The oldest events are deleted first. When the upper limit of 800 is reached, events are deleted in batches of 100 events, until the current event count is reduced to less than a system-default lower limit of 60% of 1000 events, or 600 events.

Alerts, Events, and Audit Events areas
Note:
  • For details about events in SDDC Manager, see Event Catalog.

  • For details about alerts that are raised during system operations, see SDDC Manager Alerts Raised During Ongoing Operations.

  • For details about alerts that are raised during Power On System Validation (POSV), see the Alerts List section of the VMware Cloud Foundation Overview and Bring-Up Guide.

Examining, Filtering, and Clearing Alerts

Clicking View Details for the alerts displays a page in which you can examine and clear the alerts that have been raised. Alerts are raised based on dynamic discovery of problem conditions in the hardware or virtual resources. You can expand the alerts to see details such as the time an alert was reported and its description.





You can expand an alert to see details such as the time it was reported and its description.





By default, the list shows alerts of any severity (all) that have not yet been cleared (new). To see a subset, filter the list:

  • Use the Severity menu to filter by severity of the alert (critical, error, warning). To see all of the alerts, select All in the Severity drop-down menu.

  • Use the Type menu to filter by type (new, cleared). When Cleared is selected in the Type menu, only the alerts that have been cleared are displayed in the list.

After you have addressed the issue that is causing the alerts, you can clear the alerts:

  • Clear an individual alert by expanding it in the list, clicking the CLEAR ALERT button within the expanded alert, and saving the change.

  • Clear multiple alerts at once by first clicking Edit to put the page into editing mode and then selecting the check boxes next to the alerts that you want to clear, clicking CLEAR SELECTED at the top of the listing, and then saving the change.





For a list of the alerts and their descriptions, see SDDC Manager Alerts Raised During Ongoing Operations.

Examining Events

Clicking View Details for the total events list displays a screen in which you can examine the events that have occurred in the environment.

This screen includes events that have been raised by SDDC Manager within a system-default time period of fourteen days. Events that are older than fourteen days are not reported on this screen. To see the reports for events older than fourteen days, use the vRealize Log Insight instance, if your system is licensed for usage of vRealize Log Insight.

The count at the top of the screen reports the number of events raised within the system-default fourteen-day time period by SDDC Manager that have not yet been forwarded to the vRealize Log Insight instance. Because this count does not include events that have already been forwarded to the vRealize Log Insight instance, this count might be less than the number of events in the event listing below it, which includes both forwarded and not-yet-forwarded events.

The event listing in the lower part of the screen includes both forwarded events and not-yet-forwarded events, in order of occurrence. Because the not-yet-forwarded events are the most recent, those events appear at the top of the list. As you scroll down, more of the events that have been forwarded to vRealize Log Insight are displayed, until all events that have occurred within the past fourteen days are loaded into the list. You can expand each event to see details such as the time an event was reported and its description.





From the System Events page, you can:

  • Click Analysis to launch the vRealize Log Insight Web interface and use the vRealize Log Insight capabilities examine the log data and troubleshoot, or create trend reports and auditing reports from the event history. See Using vRealize Log Insight Capabilities in Your Cloud Foundation Environment.

  • Click Catalog to open the Event Catalog and view the definitions of all of the events that the software monitors and records as part of its event-driven problem detection capabilities. See Event Catalog.

Examining Audit Events

Clicking View Details for the audit events list displays a page in which you can examine the events that have occurred from user-initiated actions. You can expand the audit events to see details such as the time an event was reported, which user initiated it, and its description.





From the Audit Events page, you can:

Searching and Filtering When Viewing Details

After you click View Details to see one of the lists, you can use the displayed filtering features to see that subset that matches your selected criteria. The Workflows screen also has a search feature to search using text in a workflow's name.