VCF Operations and DX Operational Observability

We've discussed VCF Operations Alert Notifications many times before:

• Aria Operations and ServiceNow

• Send VMware Aria Operations Alerts to Slack

• Send Aria Operations Alerts to Google Chat

• Send vROps Alerts to Microsoft Teams

• vROps Alert Notifications

• vROps SNMP Plugin and ServiceNow

I recently discovered DX Operational Observability (DX O2), Broadcom's AI Ops and Observability platform which can help with Alert correlation and enrichment. DX O2 can receive Alerts from just about anything in most every format, which got me thinking about sending Alerts to it from VCF Operations. Let's do it!

The first thing to do is create a Webhook Template in VCF Operations for your Alerts. I cloned the Default Webhook Template and created one called DX O2 Webhook Template.

The details look like this.

The payload itself looks like this:

{

"startDate": "${CREATE_TIME}",

"updateDate": "${UPDATE_TIME}",

"cancelDate": "${CANCEL_TIME}",

"resourceId": "${RESOURCE_ID}",

"adapterKind": "${ADAPTER_KIND}",

"resourceKind": "${RESOURCE_KIND}",

"resourceName": "${RESOURCE_NAME}",

"Health": "${OBJECT_HEALTH_STATE}",

"impact": "${ALERT_IMPACT}",

"criticality": "${ALERT_CRITICALITY}",

"alertName": "${ALERT_DEFINITION}",

"symptomName": "${SYMPTOMS}",

"alertId": "${ALERT_ID}",

"status": "${ALERT_STATUS}",

"recommendations": "${ALERT_RECOMMENDATIONS}",

"alertURL": "${LINK_TO_ALERT}"

}

You'll notice I added symptomName because this is what contains the details for the Alerts I'm going to start sending to DX O2, but you can add whatever variables you'd like.

Next you'll need to create the VCF Operations Outbound Plugin instance for DX O2.

Click ADD and create one using the Webhook Notification Plugin, mine looks like this.

I've given it a descriptive name and a URL I got from DX O2. In DX O2 go to Settings - Setup Integrations to get your Webhook URL.

Click Setup Integrations - Add - Standard Integration top right.

Give the Integration a Name and Product, the Webhook URL can be copied from the link top right.

This is the URL you'll use in the VCF Operations Webhook Plugin.

You'll also need a Bearer Token, which you can get from DX O2 here.

Once your DX O2 Bearer Token has been added to your Webhook Plugin, you can run a TEST to confirm your Plugin works.

Over in DX02 your test Alert will look like this.

Now, DX O2 needs to know what the VCF Operations Alert payload will look like. It will also need to map the VCF Operations Alert fields to DX O2 Alarm fields using JSONATA, mine looks like this.

Once you've created your Mapping Definition you can click the Play button top right to confirm it works, which mine does. The Show Samples Integration link is helpful in creating your Mapping Definition. My Mapping Definition is pretty straight forward, besides the alarmMessage, which I create based on contents of the symptonName being sent in.

{

"alarms": [

{

"alarmId": alertId,

"host": resourceName,

"hostname": resourceName,

"status": status,

"severity": criticality,

"alarmType": "VCF Operations",

"alarmMessage": $contains(symptomName, "guestfilesystem:") ?

"Filesystem Alert: " & $substringBefore($substringAfter(symptomName, "guestfilesystem:"), "|") & " at " & $substringBefore($substringAfter(symptomName, ": "), " >") & "%"

: alertName & " " & symptomName,

"alarmUrl": alertURL,

"entityId": resourceId,

"monitoringType": adapterKind,

"created": startDate

}

]

}

Lastly, you'll need a VCF Operations Notification Rule that uses your new Webhook Notification Plugin and Template, mine looks like this.

This will send the relevant VCF Operations Alerts over to DX O2. DX O2 will then transform that Alert into a DX O2 Alarm. In my case, I cleaned up the Alarm Message to look like this.

There are all sorts of other things we can do here, but we now have VCF Operations Alerts being sent to DX O2 for processing, correlation, enrichment, and more. Hope this was helpful!