The add symptom definitions options are the mechanisms you use to add existing symptoms or to create new symptoms for the alert definition. If the symptom that you need for an alert definition does not exist, you can create it from this workspace.

You can select and add symptoms defined for the base object type, and you can add symptoms for related object types. As you add one or more symptoms, you create a symptom expression. If this expression is evaluated as true, then the alert is generated.

To create or edit your alert definitions, select Content > Alert Definition in the left pane. On the Alert Definitions toolbar, click the plus sign to add a definition, or click the pencil to edit the selected definition. In the workspace, on the left, click Add Symptom Definitions.

To add symptom definitions, you use the left pane to select your symptoms. You use the workspace on the right to define the point at which the symptoms or symptom sets are true. You also use the workspace to specify whether all or any of the symptoms or symptom sets must be true to generate an alert.

Add Symptoms Selection Options

Option

Description

Defined On

Object that the symptom evaluates.

As you create alert definitions, you can select or define symptoms for the base object type and for related object types, based on the object relationship hierarchy. The following relationships are object types as they relate to the alert definition base object type.

Self. A base object type for the alert definition. For example, host system.

Descendant. An object type that is at any level below the base object type, either a direct or indirect child object. For example, a virtual machine is a descendant of a host system.

Ancestor. An object type that is one or more levels higher than the base object type, either a direct or indirect parent. For example, a datacenter and a vCenter Server are ancestors of a host system.

Parent. An object type that is in an immediately higher level in the hierarchy from the base object type. For example, a datacenter is a parent of a host system.

Child. An object type that is one level below the base object type. For example, a virtual machine is a child of a host system.

Filter by Object Type

Available only when you select a Defined On value other than Self.

Limits the symptoms to those that are configured for the selected object type based on the selected Defined On relationship.

Symptom Definition Type

Select the type of symptom definition that you are adding for the current Defined On object type.

Metric / Supermetric. Add symptoms that use metric and super metric symptoms. These metrics are based on the operational or performance values that vRealize Operations Managercollects from target objects in your environment.

Property. Add symptoms that use property symptoms. These symptoms are based on the configuration properties that vRealize Operations Manager collects from the target objects in your environment.

Message Event. Add symptoms that use message event symptoms. These symptoms are based on events received as messages from a component of vRealize Operations Manager or from an external monitored system through the system's REST API.

Fault Event. Add symptoms that use fault symptoms. These symptoms are based on events that monitored systems publish. vRealize Operations Manager correlates a subset of these events and delivers them as faults. Faults are intended to signify events in the monitored systems that affect the availability of objects in your environment.

Metric Event. Add symptoms that use metric event symptoms. These symptoms are based on events communicated from a monitored system where the selected metric violates a threshold in a specified manner. The external system manages the threshold, not vRealize Operations Manager. These symptoms are based on conditions reported for selected metrics by an external monitored system, as compared to metric symptoms, which are based on thresholds that vRealize Operations Manager is actively monitoring.

Smart Early Warning. Add a symptom that uses a defined condition that is triggered when the number of anomalies on an object is over the trending threshold. This symptom represents the overall anomalous behavior of the object. Anomalies are based on vRealize Operations Manager analysis of the number of applicable metrics that violate the dynamic threshold that determines the normal operating behavior of the object. This symptom is not configurable. You either use it or you do not use it.

Add symptom button

If symptoms that you need for your alert do not exist, you can create them.

Opens the symptoms definition dialog box.

Not available for Smart Early Warning symptoms, which are predefined in the system.

All Filters

Filter the list of symptom definitions. This selection is available when Defined On is set to Self, or when it is set to another relationship and you select an object from the Filter by Object Type drop-down menu.

Symptom. Type text to search on the name of the symptom definitions. For example, to display all symptom definitions that have efficiency in their name, type Efficiency.

Defined By. Type text to search for the name of the adapter that defined the symptom definitions. For example, to display all symptom definitions provided by the vCenter Adapter, type vCenter. To display only user-defined symptom definitions, type the search term User.

To clear a filter, click the double arrow icon and the red x that appears next to the filter name.

Quick filter (Name)

Search the list based on the symptom name.

Symptoms list

List of existing symptoms for the selected object type. To configure a symptom, drag it into the workspace.

To combine symptoms that are based on multiple levels in the hierarchy, select the new Defined On level and Filter by Object Type before you select and drag the new symptom to the workspace.

Use the workspace to configure the interaction of the symptoms and symptom sets.

Symptom Sets in the Alert Definition Workspace

Option

Description

Alert Definition Summary

The currently configured information for the alert definition. Use the information as reference when you create alert definitions.

Symptoms

The symptom sets comprise an expression that is evaluated to determine if an alert should be triggered.

To add one or more symptoms from the symptom list to an existing symptom set, drag the symptom from the list to the symptom set. To create a new symptom set for the alert definition, drag a symptom to the landing area outlined with a dotted line.

Match {operator} of the following symptom sets

Select the operator for all of the added symptom sets. Available only when you add more than one symptom set.

All. All of the symptom sets must be true before the alert is generated. Operates as a Boolean AND.

Any. One or more of the symptom sets must be true before the alert is generated. Operates as a Boolean OR.

Symptom sets

Add one or more symptoms to the workspace, define the points at which the symptom sets are true, and specify whether all or any of the symptoms in the symptom set must be true to generate the alert.

A symptom set can include one or more symptoms, and an alert definition can include one or more symptom sets.

If you create a symptom set where the Defined On object is Self, you can set the operator for multiple symptoms in the symptom set.

If you create a symptom set where the Defined On object is a relationship other than Self, you can set the operator and modify the triggering threshold. To configure the symptom set criteria, you set the options.

Value operator. Specifies how the value you provide in the value text box is compared to a number of related objects to evaluate the symptom set as true.

Value text box. Number of objects of the specified relationship, based on the value type, that are required to evaluate the symptom set as true.

Value type. Possible types include the following items:

Count. Exact number of related objects meet the symptom set criteria.

Percent. Percentage of total related objects meet the symptom set criteria.

Any. One or more of the related objects meet the symptom set criteria.

All. All of the related objects meet the symptom set criteria.

Symptom set operator. Operator applied between symptoms in the symptom set.

All. All of the symptoms must be true before the alert is generated. Operates as a Boolean AND.

Any. One or more of the symptoms must be true before the alert is generated. Operates as a Boolean OR.

When you include a symptom in a symptom set, the condition must become true to trigger the symptom set. However, you might want to configure a symptom set where the absence of a symptom condition triggers a symptom. To use the absence of the symptom condition, click the Negate This Symptom Condition icon to the left of the symptom name.

Although you can configure symptom criticality, if you negate a symptom, it does not have an associated criticality that affects the criticality of generated alerts.