You can configure alert queries in Log Insight to send notification events to vCenter Operations Manager when specific Log Insight queries return results above a given threshold.

Notification events that Log Insight generates are associated with resources in vCenter Operations Manager. You can read more about resources in the vCenter Operations Manager Getting Started Guide (Custom UI)

Note

Several minutes are required for notification events to appear in the vCenter Operations Manager user interface.

Verify that you are logged in to the Log Insight Web user interface. The URL format is https://log_insight-host, where log_insight-host is the IP address or host name of the Log Insight virtual appliance.

Verify that an administrator has configured the connection between Log Insight and vCenter Operations Manager to enable alert integration. See Enable the Sending of Notification Events to vCenter Operations Manager.

1

On the Interactive Analytics tab, run the query for which you want notifications to be sent .

2

From the menu on the right of the Search button, click and select Create Alert from Query....

3

In the Add Alert dialog box, type a name for the alert, and provide a short and meaningful description of the event that triggers the alert.

The alert name and description are included in the notification event that Log Insight sends.

Note

The description of the alert is only visible in the email message that Log Insight sends.

4

Deselect the Email check box or provide at least one email address to receive the notification events.

Use commas to separate multiple addresses.

5

Select Send to vCenter Operations Manager.

6

Click Select to choose a vCenter Operations Manager resource to be associated with the notification events that Log Insight sends.

7

In the Select vCenter Operations Manager Resource to Receive Alert dialog box, type a resource name or browse for an object in the list.

You can use the drop-down menu to filter resources by power state.

Option

Description

Active VMs

Select to view only resources that are powered on.

All Resources

Select to view all resources, regardless of their power state.

8

From the Criticality drop-down menu, select the criticality level for the notification events that appear in vCenter Operations Manager Custom user interface.

9

Set the alert threshold.

Alert Type

Selection

Any Match

Select the on any match option.

Queries run every 5 minutes.

Based on number of events within a period of time

Select the second option and use the drop-down menus to set the parameters.

Queries run based on your selection in the second drop-down menu.

Based on chart values

Select the third radio button and use the drop-down menus to configure the parameters.

Note

This alert type is available only if you select to group events according to at least one field. You cannot create this alert type for charts that visualize only time series.

Queries run based on your selection in the second drop-down menu.

The orange line in the preview chart shows the current threshold.

10

Click Save.

When the alert query returns results that match the alert criteria, a notification event is sent to vCenter Operations Manager. Alert queries run on a predefined schedule and are triggered only once for a given threshold time range.

The locations where notification events appear depend on the vCenter Operations Manager user interface that you use. See Log Insight Notification Events in vCenter Operations Manager.

Assume that in vCenter Operations Manager you have a virtual machine resource named vm-abc.

You have configured Log Insight to pull events from the vCenter Server system where the virtual machine vm-abc runs.

You want to receive a notification in vCenter Operations Manager each time the vm-abc virtual machine is powered off.

Here is how to configure Log Insight to send these notification events to vCenter Operations Manager.

1

In the search text box, type Power Off virtual machine.

2

Click Add a Filter, select vc_vm_name and type vm-abc.

3

Click Search.

If the vm-abc virtual machine has been powered off during the selected time range, the search returns all instances that occurred.

4

From the drop-down menu on the right of the Search button, select Add Alert.

5

In the Add Alert dialog box, type a name and description for the alert, unselect the Email checkbox, and select Send to vCenter Operations Manager.

6

Click Select, type vm-abc, and click Search to find the vm-abc resource in the list.

7

Click the vm-abc resource in the list to add it.

8

(Optional) Modify the criticality level that is displayed in the vCenter Operations Manager Custom user interface.

9

Under Raise an alert, select on any match.

10

Click Save.

Log Insight polls the vCenter Server system at five-minute intervals. If the query returns a new Power Off virtual machine task from VM vm-abc , Log Insight sends a notification event that is associated with the vm-abc resource in vCenter Operations Manager.

You can enable, disable, or delete your saved alerts.

Note

Alert queries are user specific. You can manage only your own alerts.