Message event symptoms are based on message events received from a component of vRealize Operations Manager or from an external monitored system through the system's REST API. You define message event systems so that you can create one or more of the symptoms that you can add to an alert definition.

A message event symptom is triggered when a message in an incoming event matches the text string in the symptom based on the specified operator.

To define symptoms based on message events, in the menu, click Alerts and then in the left pane, click Alert Settings > Symptom Definitions. Click Add to define a property-based symptom in the workspace.

You can also define symptoms as you are defining alerts in the Alert Definition Workspace.

Symptoms Workspace Options for Message Events



Message Event Selector

Components that you use to create symptoms.

Based Object Type

Object against which the symptom is evaluated.

Select the Type of Event

Select the type of incoming event against which you are matching the events as they arrive. The incoming event must contain the following type and subtype combinations.

System Performance Degradation.


Environment Down.


Symptom definition workspace

Drag the event type to the right pane.

Message Event

The Message Event text string is compared to the message in the incoming event by using the specified operator. You can configure a single message event symptom or add multiple symptoms.

For example, the VMware adapter sends a change event when the CPU limit for a virtual machine was changed from unlimited to 2 GHz. You can create a symptom to detect CPU contention issues as a result of this configuration change.

Configure the options:

Operator. Determines how the string that you specify in the event message text box is evaluated against the message in the event when the symptom definition is evaluated.

Event message. String that the operator evaluates.

Criticality level. Severity of the symptom when it is triggered.

Symptom name. Name of the symptom as it appears in the symptom list when configuring an alert definition, as it appears when the alert is generated, and when viewing triggered symptoms.

Wait Cycle. The trigger condition should remain true for this number of collection cycles before the symptom is triggered. The default value is 1, which means that the symptom is triggered in the same collection cycle when the condition became true.

Cancel Cycle. The symptom is canceled after the trigger condition is false for this number of collection cycles after which the symptom is cancelled. The default value is 1, which means that the symptom is canceled in the same cycle when the condition becomes false.