You might need to see all recently triggered vSphere alarms when doing the following:
Prerequisites
In order to execute this procedure in your environment, the following data, services, or apps are required:
Example
VMware vSphere lets you author alerting rules to identify various conditions that occur in your VMware environment. Some alerts indicate problems while others are informational. You want a search that allows you to easily see all alarms so that you can review them and investigate further if necessary.
NOTE: To optimize the search shown below, you should specify an index and a time range.
- Run the following search:
sourcetype="vmware:events" alarm.name=*
|table _time host.name from to fullFormattedMessage
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
Splunk Search |
Explanation |
sourcetype="vmware:events" |
Search only VMware events data. |
alarm.name=* |
Return all VMware alarms. |
|table _time host.name from to fullFormattedMessage |
Display the results in a table with columns in the order shown. |
Result
The table shows the time each alarm was triggered, the host they were triggered on, the host’s previous status and current status after the alarm, and the alarm’s message. Depending on the types of rules you author and activate, it might be helpful to correlate VMware alerts with other operational and performance metrics associated with the applications running on the virtual machine.
_time |
host.name |
from |
to |
fullFormattedMessage |
2020-11-03T01:23:27.000+0000 |
apps-esxi503.sv.splunk.com |
gray |
green |
Alarm 'Virtual machine cpu usage' on apps-7m-filer37 changed from Gray to Green |
2020-11-03T01:23:27.000+0000 |
apps-esxi502.sv.splunk.com |
gray |
green |
Alarm 'Virtual machine memory usage' on apps-vcenter500 changed from Gray to Green |
2020-11-03T01:23:23.000+0000 |
apps-esxi502.sv.splunk.com |
gray |
green |
Alarm 'Virtual machine cpu usage' on apps-vcenter500 changed from Gray to Green |
2020-11-03T01:23:20.000+0000 |
apps-esxi503.sv.splunk.com |
gray |
green |
Alarm 'Virtual machine memory usage' on apps-7m-filer38 changed from Gray to Green |
2020-11-03T01:23:20.000+0000 |
apps-esxi503.sv.splunk.com |
gray |
green |
Alarm 'Virtual machine cpu usage' on apps-7m-filer38 changed from Gray to Green |
Comments
0 comments
Please sign in to leave a comment.