The timeline is the generated alerts, triggered symptoms, and change events over time for the impacted object. You use the timeline to determine when alerts, symptoms, and events appeared so that you can identify a change or event that contributed to triggering the symptoms.

How the Alert Details Timeline Works

The timeline view includes alerts, symptoms, and events for the impacted object starting 6 hours before the alert is generated. To view the data for a particular time, click on the timeline in one of the three tiers and move your mouse to the left to see data from the past or to the right to move back to present.

The view is limited to approximately 50 alerts, symptoms, and events. If your timeline includes more than this number, you can use the toolbar options to remove data from the timeline until it contains data that you find useful for your investigation.

Where You Find the Alert Details Timeline

In the left pane, click the Alerts icon. On the Alerts, Health Alerts, Risk Alerts, or Efficiency Alerts lists, click the alert name in the data grid, and click the Timeline tab.

Table 1. Timeline Options

Option

Description

Impact

If selected, displays the Health, Risk, and Efficiency alerts in the timeline.

Show Symptoms

If selected, all triggered symptoms appear in the timeline.

You might see triggered symptoms for alerts where an alert is not generated. These symptoms appear because the object exhibited the behavior defined in the symptom definition, even when the symptom is not included in an alert.

Select Event Type

Add events to the timeline so that you evaluate them against the alerts and triggered symptoms. Adding events that occurred concurrent with symptoms that triggered an alert allows you to determine if something occurred in your environment that caused the alert.

You and add one or more of the following events to the timeline.

  • Dynamic threshold violation. A dynamic threshold is a value that marks the boundary between normal and abnormal behavior for a metric that is tracked over time. When a metric crosses one of its thresholds, either above or below, vRealize Operations Manager generates an anomaly. If you select this option, the anomalies are added to the timeline, allowing you to evaluate them in the context of the alerts.

  • Change. A change event is any change to the monitored system. It can include changes on objects, such as adding, removing, connecting, or disconnecting object, or starting, stopping, or reconfiguring an object. If you select this option, the change events are added to the timeline, allowing you to evaluate them in the context of the alerts. The retrieved changes depend on the adapter that manages the monitored system.

  • Fault. A fault event is an event retrieved from the monitored system that might contribute to problems with an object, including generating an alert or triggering a symptom. If you select this option, the fault events are added to the timeline, allowing you evaluate them in the context of the alerts. The retrieved faults depend on the adapter that manages the monitored system.

Select Status

Limits the alerts in the timeline to canceled or active alerts.

Select Criticality Levels

Limits the alerts in the timeline to the alerts for the selected criticality level.

Show Self Events

Displays the alerts and symptoms for the impacted object.

This is the default timeline view. You can use the self events in conjunction with ancestor, descendent, and peer events to create a timeline that provides insight regarding events on children or parents that contribute to the alert.

Show Ancestor Events

Displays the alerts and symptoms for the ancestors of the impacted object.

Ancestors are the parents, grandparents, and so on, of the object. For example, the ancestors of a host are a folder, storage pod, cluster, data center, and vCenter Server instance.

Show Descendant Events

Displays the alerts and symptoms for the descendants of the impacted object.

Descendants are the children and grandchildren of the object. For example, the descendants of a host are datastores, resources pools, and virtual machines.

Show Peer Events

Displays the alerts and symptoms for objects like the impacted object.

Date Controls

Limits the data in the timeline to the selected time frame.

Timeline

Displays alerts and symptoms as a series of lines over time in three tiers, hours, days, and weeks.

To scroll through the timeline, click in any of the three tiers and drag the view left or right.

To see details for symptom, click the line representing the symptom. To go to the alert details for an associated alert, ancestor, descendant, or peer, click the line representing the alert.