vRLI Header

VMC vCenter email alerts not supported – Workaround with vRealize Log Insight Cloud

The Issue

When configuring a VMware Cloud on AWS (VMC) SDDC vCenter, Administrators trying to use the vCenter Alerts email feature find they cannot complete the configuration, as the necessary options such as setting email server settings are greyed out.

Thanks to Bilal Ahmed for discussing this issue with me, so we could find a solution.
The Cause

Today this feature is not supported in VMware Cloud on AWS

The Workaround

By creating the vCenter Alert, even if it triggers to alert a placeholder email address. This will generate a vCenter event which is captured by vRealize Log Insight Cloud (vRLIC), the offering which is included with VMC (the freemium version included with VMC will sufficed for the workaround).

Within vRealize Log Insight you can generate an email alert from a query.

Obviously, a full monitoring suite is where you should be really heading for these types of information gathering and notifications such as vRealize Operations Cloud. However, this will suffice as a workaround where that option is not possible.

The vRealize Log Insight Cloud collects and analyzes logs generated in your SDDC.

A trial version of the vRealize Log Insight Cloud add-on is enabled by default in a new SDDC. The trial period begins when a user in your organization accesses the vRealize Log Insight Cloud add-on and expires in thirty days. After the trial period, you can choose to subscribe to this service or continue to use a subset of service features at no additional cost. 
Source
Example – Datastore Usage

You can do this for any vCenter Alarm type, but I am using datastore usage space as an example

  • First, we will create the vCenter Alarm

Below I will go through the steps for setting up a datastore usage alert, capture the event in vRLIC which will generate an email.

  • Within vCenter, click the vCenter Object
  • Click Configure tab
  • Click Alarm Definitions
  • Click to Add a new Definition

VMC vCenter Alarms - Create an Alarm Definition

  • Provide a Name and Description for the Definition
  • Select the Target Type
  • Click Next

VMC vCenter Alarms - New Alarm Definition - Name and Targets

  • Select your trigger, you can set multiple triggers if needed

VMC vCenter Alarms - New Alarm Definition - Alarm Rule 1 - Select a Trigger

  • Select the alarm status (warning or critical)
  • You don’t need to send any type of alert externally (as it doesn’t work anyway)
  • Select to run a script if necessary.

From here you can build up additional rules into this definition if needed. Click Next once you are done.

VMC vCenter Alarms - New Alarm Definition - Alarm Rule 1 - Set alarm triggered status

A Reset rule will be generated for you.

  • Review your rules then ensure it is enabled and click Create.

VMC vCenter Alarms - New Alarm Definition - Alarm Rule 1 - Review

Move into your vRealize Log Insight Cloud UI. Now we will create the query in vRealize Log Insight Cloud, that captures the logs we are interest in when the vCenter Alarm is triggered. From this query we will create an Alert in vRLIC.

In my example I used a trigger that would happen and log an event straight away. But you can manually build this in the filters if the event hasn’t happened yet.

  • Search for an event from a triggered Alarm, by searching the Alarm Definition name in the Explore logs section

VMC vCenter Alarms - Log Insight Cloud - Explore Logs

In the returned results, we will filter based on two field extracts, you can set these manually using the “+ add filters” option in the UI:

  • vmw_vmc_audit_alarm
    • This is the alarm definition name
  • vmw_vmc_audit_alarm_current_state
    • Yellow – Trigger is status of “Warning”
    • Red – Trigger is status of “Red”

VMC vCenter Alarms - Log Insight Cloud - Explore Logs - Add Filter

Now I have my two filters set, I’ve removed the plain text search criteria I set earlier as well.

  • Click the floppy disk icon to save the query.

VMC vCenter Alarms - Log Insight Cloud - Explore Logs - Filter set - Save Query

  • Provide a Name and Description for the Query.

VMC vCenter Alarms - Log Insight Cloud - Explore Logs - Filter set - Save Query 2

  • Now you will see the query name has been set
  • Click the warning triangle icon to create an Alert from this query

VMC vCenter Alarms - Log Insight Cloud - Explore Logs - Filter set - Create Alert based on this query

  1. Provide a name for the alert
  2. Provide a description for the alert
  3. The query will be set for you, but you can change and alert it if needed.
  4. Set the trigger conditions for the alert in vRLIC
  5. Set the email recipient/s
  6. Click Save

If needed you can further customize the alert, such as which logs to include in the Alert notification and any additional metadata that needs to be added to the Alert.

VMC vCenter Alarms - Log Insight Cloud - Create a new alert

You will now be taken to the Alert configuration page.

  • Enable the Alert

VMC vCenter Alarms - Log Insight Cloud - Enable new alert

Below is an example email notification from the triggered Alert in vRLIC when a log is ingested to the platform and matches the query we configured.

VMC vCenter Alarms - Log Insight Cloud - Alert email example

We can also view the Alert configuration and under the “Alert Instances” tab, see all the occasions the Alert was triggered.

VMC vCenter Alarms - Log Insight Cloud - Alert Instances

Regards

Dean Lewis

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.