Alert Definition Workspace Add Symptoms/Conditions

The add symptom definitions options are the mechanisms you use to add existing symptoms or to create new symptoms for the alert definition. If the symptom that you need for an alert definition does not exist, you can create it from this workspace. You can also add conditions for your alert.

How the Add Symptoms/Conditions Option Work

You can select and add symptoms defined for the base object type, and you can add symptoms for related object types. As you add one or more symptoms, you create a symptom expression. If this expression is evaluated as true, then the alert is generated. You can similarly define one or more conditions for your alert, and when the conditions are met, the alert is generated. You can view the alert in the All Alerts page.

Add Symptoms/Conditions Option

To add symptoms/conditions, you can drag the selected symptom/condition in to the left pane. Use the workspace on the left to specify whether all or any of the symptoms/conditions or symptom/condition sets must be true to generate an alert.

Table 1. Add Symptoms/Conditions Selection Options

Option	Description
Defined On	Object that the symptom evaluates. As you create alert definitions, you can select or define symptoms for the base object type and for related object types, based on the object relationship hierarchy. The following relationships are object types as they relate to the alert definition base object type. Self. A base object type for the alert definition. For example, host system. Descendant. An object type that is at any level below the base object type, either a direct or indirect child object. For example, a virtual machine is a descendant of a host system. Ancestor. An object type that is one or more levels higher than the base object type, either a direct or indirect parent. For example, a data center and a vCenter Server are ancestors of a host system. Parent. An object type that is in an immediately higher level in the hierarchy from the base object type. For example, a data center is a parent of a host system. Child. An object type that is one level below the base object type. For example, a virtual machine is a child of a host system.
Symptoms tab
Select Symptom	Select the type of symptom definition that you are adding for the current Defined On object type. Metric / Property. Add symptoms that use metric and property symptoms. These metrics are based on the operational or performance values, and configuration properties that vRealize Operations collects from target objects in your environment. Message Event. Add symptoms that use message event symptoms. These symptoms are based on events received as messages from a component of vRealize Operations or from an external monitored system through the system's REST API. Fault Event. Add symptoms that use fault symptoms. These symptoms are based on events that monitored systems publish. vRealize Operations correlates a subset of these events and delivers them as faults. Faults are intended to signify events in the monitored systems that affect the availability of objects in your environment. Metric Event. Add symptoms that use metric event symptoms. These symptoms are based on events communicated from a monitored system where the selected metric violates a threshold in a specified manner. The external system manages the threshold, not vRealize Operations . These symptoms are based on conditions reported for selected metrics by an external monitored system, as compared to metric symptoms, which are based on thresholds that vRealize Operations is actively monitoring. Smart Early Warning. Add a symptom that uses a defined condition that is triggered when the number of anomalies on an object is over the trending threshold. This symptom represents the overall anomalous behavior of the object. Anomalies are based on vRealize Operations analysis of the number of applicable metrics that violate the dynamic threshold that determines the normal operating behavior of the object. This symptom is not configurable. You either use it or you do not use it.
Filter by Object Type	Available only when you select a Defined On value other than Self. Limits the symptoms to those that are configured for the selected object type based on the selected Defined On relationship.
Create New Symptom	If symptoms that you need for your alert do not exist, you can create them. Opens the symptoms definition dialog box. Not available for Smart Early Warning symptoms, which are predefined in the system.
All Filters	Filter the list of symptom definitions. This selection is available when Defined On is set to Self, or when it is set to another relationship and you select an object from the Filter by Object Type drop-down menu. Symptom. Type text to search on the name of the symptom definitions. For example, to display all symptom definitions that have efficiency in their name, type Efficiency. Defined By. Type text to search for the name of the adapter that defines the symptom definitions. For example, to display all symptom definitions provided by the vCenter Adapter, type vCenter. To display only user-defined symptom definitions, type the search term User. To clear a filter, click the double arrow icon that appears next to the filter name.
Quick filter (Name)	Search the list based on the symptom name.
Symptoms list	List of existing symptoms for the selected object type. To configure a symptom, drag it into the left workspace. To combine symptoms that are based on multiple levels in the hierarchy, select the new Defined On level and Filter by Object Type before you select and drag the new symptom to the workspace.
Conditions tab
Select Specific Object	Select a specific object based on its object type, adapter type, policy, collection state, and status.
Filter	Search the metrics based on object type.
Conditions list	List of metrics for the selected object type. To configure a condition, drag it into the left workspace.

Use the workspace to configure the interaction of the symptoms, symptom sets, and conditions.

Table 2. Symptom Sets in the Alert Definition Workspace

Option	Description
Trigger alert when {operator} of the symptom sets are true	Select the operator for all of the added symptom/condition sets. Available only when you add more than one symptom/condition set. All. All of the symptom/condition sets must be true before the alert is generated. Operates as a Boolean AND. Any. One or more of the symptom/condition sets must be true before the alert is generated. Operates as a Boolean OR.
Symptoms	The symptom/condition sets comprise an expression that is evaluated to determine if an alert should be triggered. To add one or more symptoms from the symptom list to an existing symptom set, drag the symptom from the list to the symptom set. To create a new symptom set for the alert definition, drag a symptom to the landing area outlined with a dotted line.
Symptom sets	Add one or more symptoms to the workspace, define the points at which the symptom sets are true, and specify whether all or any of the symptoms in the symptom set must be true to generate the alert. A symptom set can include one or more symptoms/conditions, and an alert definition can include one or more symptom/condition sets. If you create a symptom set where the Defined On object is Self, you can set the operator for multiple symptoms in the symptom set. If you create a symptom set where the Defined On object is a relationship other than Self, you can set the operator and modify the triggering threshold. To configure the symptom set criteria, you set the options. Value operator. Specifies how the value you provide in the value text box is compared to a number of related objects to evaluate the symptom/condition set as true. Value text box. Number of objects of the specified relationship, based on the value type, that are required to evaluate the symptom/condition set as true. Value type. Possible types include the following items: Count. Exact number of related objects meet the symptom/condition set criteria. Percent. Percentage of total related objects meet the symptom/condition set criteria. Any. One or more of the related objects meet the symptom/condition set criteria. All. All of the related objects meet the symptom/condition set criteria. Symptom set operator. Operator applied between symptoms/conditions in the symptom set. All. All of the symptoms/conditions must be true before the alert is generated. Operates as a Boolean AND. Any. One or more of the symptoms/condition must be true before the alert is generated. Operates as a Boolean OR. When you include a symptom in a symptom set, the condition must become true to trigger the symptom set. However, you might want to configure a symptom set where the absence of a symptom condition triggers a symptom. To use the absence of the symptom condition, click the vertical ellipsis on the left of the symptom name and select Invert Symptom. Although you can configure symptom criticality, if you invert a symptom, it does not have an associated criticality that affects the criticality of generated alerts.

Table 3. Conditions in the Alert Definition Workspace

Option	Description
Alert is triggered when {operator} of the sets are true	Select the operator for all of the added condition sets. Available only when you add more than one condition set. All. All of the condition sets must be true before the alert is generated. Operates as a Boolean AND. Any. One or more of the condition sets must be true before the alert is generated. Operates as a Boolean OR.
Conditions	The condition sets comprise an expression that is evaluated to determine if an alert should be triggered. Condition. Determines how the value you specify in the value text box is compared to the current value of the metric or property when the condition is evaluated. Value. Value that specifies the threshold. Criticality level. Severity of the symptom/condition when it is triggered. Wait Cycle. The trigger condition should remain true for this number of collection cycles before the symptom/condition is triggered. The default value is 1, which means that the symptom/condition is triggered in the same collection cycle when the condition became true. Note: You cannot edit the wait cycle while defining conditions for Properties and Population. Cancel Cycle. The symptom/condition is canceled after the trigger condition is false for this number of collection cycles after which the symptom/condition is cancelled. The default value is 1, which means that the symptom/condition is canceled in the same cycle when the condition becomes false. Note: You cannot edit the cancel cycle while defining conditions for Properties and Population. To add one or more conditions from the condition list to an existing symptom/condition set, drag the condition from the list to the symptom/condition set.

Click Next to add recommendations.