vROps Alert Notifications

Last time we discussed vROps Alerts and Symptoms. Let's explore what we can actually do with those Alerts once we receive them. Within the vROps UI there is a rich Alerts panel that publishes all Alerts. It is highly customizable, offering five Group By settings, an Actions drop down, and Filters. These can be used to explore vROps Alerts in more detail and take some actions.

What if I want to notify a user or support group on an Alert. This is where Alert Notifications are used. Alert Notifications are rules defined against Alerts, that employ a Notification method as defined in Outbound Settings.

To be clear, there are two vROps constructs at work here:

1. Outbound Settings Plugin Types, the Plugin that actually sends an Alert to a destination. https://docs.vmware.com/en/vRealize-Operations-Manager/8.1/com.vmware.vcom.core.doc/GUID-5E26AB4D-6F66-4460-AB3F-BCF81C7F3F52.html:

   1. Automated Action Plugin

   2. Log File Plugin

   3. Smarts SAM Notification Plugin

   4. REST Notification Plugin

   5. Network Share Plugin

   6. Standard Email Plugin

   7. SNMP Trap Plugin

   8. Slack Plugin

   9. Service-Now Notification Plugin

2. Alert Notification Rules, the Rules defined against Alerts using Outbound Settings Plugin instances as their method of notification. https://docs.vmware.com/en/VMware-vRealize-Operations-Cloud/services/config-guide/GUID-86831697-53E3-4B55-8E91-2483583FD132.html:

   1. Log File Plugin

   2. Rest Notification Plugin

   3. Standard Email Plugin

   4. SNMP Trap Plugin

   5. Slack Plugin

   6. Service-Now Notification Plugin

Alert Notification Rules are defined by the following fields. https://docs.vmware.com/en/VMware-vRealize-Operations-Cloud/services/config-guide/GUID-86831697-53E3-4B55-8E91-2483583FD132.html:

1. Name - Name of Rule

2. Method - Outbound Settings Plugin Type and Instance

3. Notification Status - Enable/Disable Notification

4. Filtering Criteria

   1. Scope: Object Type, Object, Tags, Applications, or Tiers

   2. Notification Trigger: Alert Type, Impact, or Alert Definition

   3. Criticality: Info, Warning, Immediate, and/or Critical

5. Advanced Filters

   1. Alert States: Opened, Assigned, Suspended

   2. Alert Status: Cancelled, Updated, New

   3. Collector/Group: collectors/groups available

The Method allows you to select the Outbound Settings Plugin Type and Instance you want to use to send the vROps Alerts to its destination. In vROps 8.1 there are six methods out of the box (https://docs.vmware.com/en/vRealize-Operations-Manager/8.1/com.vmware.vcom.core.doc/GUID-230B9142-C290-4659-9CA5-F7CC152A4FE1.html):

1. Log File Plugin - logs alerts to a file on each of your vROps nodes. In vROps multiple node cluster configurations, each node processes and logs the alerts for the objects that it monitors. You can use other applications to filter and manage the logs. (https://docs.vmware.com/en/vRealize-Operations-Manager/8.1/com.vmware.vcom.core.doc/GUID-BFB0D19C-854C-48C7-A7A1-05C1F58AE433.html). An example here might be a three node cluster: master node, data node, and remote collector. I'd like all three nodes to log all Alerts. I can do this by setting up a log file plugin instance for each node, then configuring that Notification to take place on all Alerts

2. Rest Notification Plugin - sends vROps alerts to a REST-enabled application where you've built a REST Web service to accept these messages. The REST plugin supports enabling an integration, it does not provide an integration. Depending on your target application, you might need an intermediary REST service or some other mechanism that will correlate the alert and object identifiers included in the REST alert output with the identifiers in your target application. (https://docs.vmware.com/en/vRealize-Operations-Manager/8.1/com.vmware.vcom.core.doc/GUID-2A26A734-CD91-43E0-BF42-B079D5B0F5D4.html). Often times these are Webhook Shims: https://blogs.vmware.com/management/2017/01/vrealize-webhooks-infinite-integrations.html, which act as an intermediary between vROps and the Alert destination.

3. Standard Email Plugin - sends vROps alerts to an email via Simple Mail Transfer Protocol (SMTP). This requires an SMTP Host, SMTP Port, and several other fields. https://docs.vmware.com/en/vRealize-Operations-Manager/8.1/com.vmware.vcom.core.doc/GUID-85341B7D-7177-4669-9461-265BCE581DDD.html

4. SNMP Trap Plugin - sends vROps Alerts to an SNMP receiver, ie ServiceNow, IBM Tivoli Netcool Omnibus, etc. There will likely be configuration work on the receiver end that requires the vROps MIBs, which can be found in $ALIVE_BASE/user/plugins/outbound/vcops-snmptrap-plugin/mibs. https://docs.vmware.com/en/vRealize-Operations-Manager/8.1/com.vmware.vcom.core.doc/GUID-62880E85-0D82-4582-AD79-0707895E7CBF.html

5. Slack Plugin - sends vROps Alerts to Slack. This requires a Webhook URL. I go into more detail here: https://bpatvmware.wixsite.com/bpatvmware/post/slack-integration-in-vrealize-operations-8-1

6. Service-Now Notification Plugin - sends vROps Alerts to ServiceNow, as Incidents. I go into more detail here: https://bpatvmware.wixsite.com/bpatvmware/post/vrops-snmp-plugin-and-servicenow