Multiple vRLI triggered Alerts not Displayed in vROps

May 25, 2023

Multiple vRLI triggered Alerts not Displayed in vROps

Last week, while supporting a customer with vRLI, I encountered an interesting challenge regarding notifications to vROps. At first, setting up the feature seemed relatively straightforward, and the customer started receiving notifications correctly. However, he had a specific requirement: he wanted to be notified when a host went into maintenance mode. Although I managed to set up the feature and it seemed to work well, a strange issue occurred when I checked the alert history.

All screenshots were taken in my home lab.

While checking the alert history, I noticed that the same alert was triggered multiple times. Surprisingly, only a single hit was recorded in vROps for this alert.

Given this discrepancy, I was determined to resolve the issue and ensure that all triggered alerts were correctly reflected in vROps. As depicted in the image above, the alert is currently in an active state. When additional same alerts are received in vRops for the same object while the first alert remains open, vROps only acknowledges the first alert until it is resolved or closed. vROps assumes that each subsequent occurrence is referring to the same alert, eliminating the need to generate duplicate alerts.

To overcome this limitation, we need to find a solution that ensures that all triggered alerts are correctly reflected in vROps. As I previously mentioned, when the same alert for the same object occurs, it is displayed only once. Although we cannot modify the object, but we could modify the alert to appear differently each time by adding a field to the alert’s title.

Let’s take a look at the logs in vRLI. As you can see in the following image, the query shows that it has occurred twice in the past 6 hours. One of differences between these two events is the event ID, which is unique. Therefore, we can use the event ID and add it to the title of the alerts. However, the problem is that there is no existing field for the event ID, so we need to create it. To create a new field, select Event Types.

In the Event Types tab, you can see an aggregated view of events within the specified query range. On the left side, you will notice the number 2 , incdicating that this Event Type includes two events (as shown in the previous image). As you proceed with reading the line, you will encounter an Event preceded by a number. This number corresponds to the event ID tha was talked in previous step. Click on it to create a new filed.

Give a suitable name for this new field and click on Save.

After that, you will notice a new field added in the right column, marked with a pen icon in fornt of it, indicating that this is a custom field.

Let’s go back to the alert definition and modify this alert to include this field in its title. As you may know, it is possible to add a field to the title using ${field name}. However, please pay attention that this field must be inside the event, you can not use an event field that is not in the event context. Save the alert, and let’s check it on vRops side.