Configure the alert criteria
Alerts use criteria to evaluate data in the results of a search query, which is defined in the scope of the alert.
Some alerts only need to be evaluated based on the set of results returned from the query.
Specify that any results should trigger the alarm
- Select to base the alert on the search result count.
- In the Triggers On section, select Any.
- Click Save.
Specify that the alert is triggered when the number of search results is outside a specified range
- In the Triggers On grouping of the Criteria tab, select Range.
- Select Less Than and Greater Than, and define the range.
- Specify the number of Sustained Minutes if you only want the alert to be triggered when a search result is returned over a time period.
Set the Sustained Minutes to a period that matches the collection period for the data type. See Configure the scope of the alert to check whether the alert is evaluated on a performance collection schedule or a configuration collection schedule.
- Click Save.
Some alerts are based on the attributes of the search results instead of the number of search results. These alerts collect properties from the search results and evaluate the value of that property.
- Select to base the alert on an attribute.
- Click Find to see the list of attributes available for evaluation.
The list of available attributes is based on the object type the search returns.
- Select the unit of measure for the attribute you want to evaluate.
- Select an aggregation function to perform an operation on the search results.
- Define the rules used in evaluation in the Triggers On grouping:
The alert is triggered if any attribute is returned.
The alert is triggered when the value of the attribute is outside of a specified range.
If you select Range, configure additional settings:
- Select Less Than and Greater Than to define the range of values for which the alert should be triggered. The alert is triggered when the value is in the range, not outside of the range.
- Select Evaluate this range once against the entire result to base the alert on the total value across search results, as defined in the Aggregation Function list.
- Select Evaluate this range against each VM to base the alert on the attribute value of each search result.
- Specify the number of Sustained Minutes if you only want the alert to be triggered when a condition for an alert has been sustained over a time period.
Set the Sustained Minutes to a period that matches the collection period for the data type. See Configure the scope of the alert to check whether the alert is evaluated on a performance collection schedule, or a configuration collection schedule.
Use XPath to specify attributes for alerts (optional)
Alerts often perform mathematical operations on the properties. For such cases, you can use XPath in the Attribute field. In most cases, XPath is used to create an average or summary of multi-value properties.
For example, to get the total free space of all disk volumes in a VM, enter this query in the Attribute field:
To get the cluster storage utilization, enter this query in the Attribute field:
(sum(/cluster/datastore/freeSpace) div sum(/cluster/datastore/capacity)) * 100