{"id":1831,"date":"2024-04-17T15:08:50","date_gmt":"2024-04-17T14:08:50","guid":{"rendered":"https:\/\/thomas-kopton.de\/vblog\/?p=1831"},"modified":"2024-04-30T11:29:08","modified_gmt":"2024-04-30T10:29:08","slug":"vmware-aria-operations-for-logs-alerts-as-symptoms-in-aria-operations","status":"publish","type":"post","link":"https:\/\/thomas-kopton.de\/vblog\/?p=1831","title":{"rendered":"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations"},"content":{"rendered":"\n

As is likely known to everyone, the integration between VMware Aria Operations<\/mark> and Aria Operations for Logs<\/mark> involves forwarding alarms generated in Aria Operations for Logs to Aria Operations. If the integration has also established the link between the origin of the log message that triggered the alarm and the object in Aria Operations, the alarm in Aria Operations will be specifically “attached” to the correct object.<\/p>\n\n\n\n

As seen in the following two images, the static field vmw_vr_ops_id<\/code> ensures that the alarm triggered in Aria Operations for Logs appears as a Notification Event<\/mark> on the affected object in Aria Operations. In my case a virtual machine experiencing issues with an application.<\/p>\n\n\n\n

\"\"<\/a>
Figure 01: Log messages in Aria Operations for Logs triggering a configured alert.<\/em><\/figcaption><\/figure>\n\n\n\n
\"\"<\/a>
Figure 02: Notification Event in Aria Operations.<\/em><\/figcaption><\/figure>\n\n\n\n

This functionality is completely sufficient for many use cases and helps to quickly detect problems and identify their root causes.<\/p>\n\n\n\n

However, there are specific use cases that cannot be implemented with it. One such use case, for example, is the requirement to attach an Aria Operations Notification<\/mark> to such alarms, which in turn would trigger actions such as Webhooks<\/mark>. As of today, the configuration of Notifications does not allow Notification Events<\/mark> to be used as Alert Definitions<\/mark> under Category.<\/p>\n\n\n\n

So, if we want to use Notifications for alarms coming from Aria Operations for Logs, we need to create an Alert Definition in Aria Operations, and for that, we need a Symptom<\/mark>. The task, therefore, is to build a Symptom from a Notification Event.<\/p>\n\n\n\n

In my example, I want to build a Symptom from the Aria Operations for Logs Alarm, which arrives as a Notification Event in Aria Operations, as shown in the following image. As we can see, the name of the alarm in Aria Operations for Logs is tk-FailedESXiLoginAttempt on ${hostname}<\/code>.<\/p>\n\n\n\n

\"\"<\/a>
Figure 03: Alert definition in Aria Operations for Logs.<\/em><\/figcaption><\/figure>\n\n\n\n

The Symptom in Aria Operations is based on a Message Event<\/mark> and has the Adapter<\/mark>, Object<\/mark>, and Event<\/mark> Types<\/mark> as depicted in the following image.<\/p>\n\n\n\n

\"\"<\/a>
Figure 04: Message Event based Symptom definition in Aria Operations.<\/em><\/figcaption><\/figure>\n\n\n\n

The details of the Symptom are shown in the following image. It is important to use contains<\/code> as the condition here because Aria Operations for Logs replaces the field ${hostname}<\/code> with the FQDN corresponding to the affected ESXi system. The string in the Contains condition is tk-FailedESXiLoginAttempt<\/code>.<\/p>\n\n\n\n

NOTE:<\/mark> This is part of the string as it is currently transmitted by Aria Operations for Logs at the time of writing this post.<\/p>\n\n\n\n

\"\"<\/a>
Figure 05: Condition in the Symptom definition in Aria Operations.<\/em><\/em><\/figcaption><\/figure>\n\n\n\n

Now, with this Symptom, an Alert Definition can be created in Aria Operations. The next images show the Alert Definition in my example.<\/p>\n\n\n\n

\"\"<\/a>
Figure 06: Alert definition in Aria Operations.<\/em><\/figcaption><\/figure>\n\n\n\n
\"\"<\/a>
Figure 07: Details of the Alert definition in Aria Operations.<\/em><\/em><\/figcaption><\/figure>\n\n\n\n

With that, the Alert Definition can be further customized as usual, for example, by adding a Notification to it.<\/p>\n\n\n\n

And this is how it looks in Aria Operations when someone attempts to log in to an ESXi host via SSH with an incorrect password.<\/p>\n\n\n\n

\"\"<\/a>
Figure 08: Alarm in Aria Operations.<\/em><\/figcaption><\/figure>\n\n\n\n

Stay<\/mark><\/strong> safe<\/mark><\/strong>.<\/p>\n\n\n\n

Thomas \u2013 https:\/\/twitter.com\/ThomasKopton<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

As is likely known to everyone, the integration between VMware Aria Operations and Aria Operations for Logs involves forwarding alarms generated in Aria Operations for Logs to Aria Operations. If the integration has also established the link between the origin of the log message that triggered the alarm and the object in Aria Operations, the …<\/p>\n","protected":false},"author":1,"featured_media":1837,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[79,57,78,5,2],"tags":[58,80,25,7,3],"class_list":["post-1831","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alerting","category-aria-operations","category-aria-operations-for-logs","category-vrli","category-vrops","tag-aria-operations","tag-aria-operations-for-logs","tag-vrealize-log-insight","tag-vrli","tag-vrops"],"yoast_head":"\nVMware Aria Operations for Logs Alerts as Symptoms in Aria Operations - TOMsOps<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations - TOMsOps\" \/>\n<meta property=\"og:description\" content=\"As is likely known to everyone, the integration between VMware Aria Operations and Aria Operations for Logs involves forwarding alarms generated in Aria Operations for Logs to Aria Operations. If the integration has also established the link between the origin of the log message that triggered the alarm and the object in Aria Operations, the ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\" \/>\n<meta property=\"og:site_name\" content=\"TOMsOps\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-17T14:08:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-30T10:29:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"3070\" \/>\n\t<meta property=\"og:image:height\" content=\"1320\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Thomas Kopton\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Thomas Kopton\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#article\",\"isPartOf\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\"},\"author\":{\"name\":\"Thomas Kopton\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82\"},\"headline\":\"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations\",\"datePublished\":\"2024-04-17T14:08:50+00:00\",\"dateModified\":\"2024-04-30T10:29:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\"},\"wordCount\":522,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage\"},\"thumbnailUrl\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png\",\"keywords\":[\"Aria Operations\",\"Aria Operations for Logs\",\"vRealize log insight\",\"vRLI\",\"vROps\"],\"articleSection\":[\"Alerting\",\"Aria Operations\",\"Aria Operations for Logs\",\"vRLI\",\"vROps\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\",\"url\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\",\"name\":\"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations - TOMsOps\",\"isPartOf\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage\"},\"image\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage\"},\"thumbnailUrl\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png\",\"datePublished\":\"2024-04-17T14:08:50+00:00\",\"dateModified\":\"2024-04-30T10:29:08+00:00\",\"author\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82\"},\"breadcrumb\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/thomas-kopton.de\/vblog\/?p=1831\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage\",\"url\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png\",\"contentUrl\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png\",\"width\":3070,\"height\":1320},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1831#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/thomas-kopton.de\/vblog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#website\",\"url\":\"https:\/\/thomas-kopton.de\/vblog\/\",\"name\":\"TOMsOps\",\"description\":\"Just another VMware Cloud Management Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/thomas-kopton.de\/vblog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82\",\"name\":\"Thomas Kopton\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g\",\"caption\":\"Thomas Kopton\"},\"url\":\"https:\/\/thomas-kopton.de\/vblog\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations - TOMsOps","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/thomas-kopton.de\/vblog\/?p=1831","og_locale":"en_US","og_type":"article","og_title":"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations - TOMsOps","og_description":"As is likely known to everyone, the integration between VMware Aria Operations and Aria Operations for Logs involves forwarding alarms generated in Aria Operations for Logs to Aria Operations. If the integration has also established the link between the origin of the log message that triggered the alarm and the object in Aria Operations, the ...","og_url":"https:\/\/thomas-kopton.de\/vblog\/?p=1831","og_site_name":"TOMsOps","article_published_time":"2024-04-17T14:08:50+00:00","article_modified_time":"2024-04-30T10:29:08+00:00","og_image":[{"width":3070,"height":1320,"url":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png","type":"image\/png"}],"author":"Thomas Kopton","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Thomas Kopton","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#article","isPartOf":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831"},"author":{"name":"Thomas Kopton","@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82"},"headline":"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations","datePublished":"2024-04-17T14:08:50+00:00","dateModified":"2024-04-30T10:29:08+00:00","mainEntityOfPage":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831"},"wordCount":522,"commentCount":0,"image":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage"},"thumbnailUrl":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png","keywords":["Aria Operations","Aria Operations for Logs","vRealize log insight","vRLI","vROps"],"articleSection":["Alerting","Aria Operations","Aria Operations for Logs","vRLI","vROps"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/thomas-kopton.de\/vblog\/?p=1831#respond"]}]},{"@type":"WebPage","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831","url":"https:\/\/thomas-kopton.de\/vblog\/?p=1831","name":"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations - TOMsOps","isPartOf":{"@id":"https:\/\/thomas-kopton.de\/vblog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage"},"image":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage"},"thumbnailUrl":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png","datePublished":"2024-04-17T14:08:50+00:00","dateModified":"2024-04-30T10:29:08+00:00","author":{"@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82"},"breadcrumb":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/thomas-kopton.de\/vblog\/?p=1831"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#primaryimage","url":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png","contentUrl":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/04\/image-1.png","width":3070,"height":1320},{"@type":"BreadcrumbList","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1831#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/thomas-kopton.de\/vblog"},{"@type":"ListItem","position":2,"name":"VMware Aria Operations for Logs Alerts as Symptoms in Aria Operations"}]},{"@type":"WebSite","@id":"https:\/\/thomas-kopton.de\/vblog\/#website","url":"https:\/\/thomas-kopton.de\/vblog\/","name":"TOMsOps","description":"Just another VMware Cloud Management Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/thomas-kopton.de\/vblog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82","name":"Thomas Kopton","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g","caption":"Thomas Kopton"},"url":"https:\/\/thomas-kopton.de\/vblog\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts\/1831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1831"}],"version-history":[{"count":33,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts\/1831\/revisions"}],"predecessor-version":[{"id":1891,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts\/1831\/revisions\/1891"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/media\/1837"}],"wp:attachment":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}