vCOPs -- used to generate vcenter alerts INSTEAD of configuring actions on vcenter server?

[TedH256]

Hi -

just wondering - is vCOPs a capable alerting/monitoring product, in addition to being a capacity utilization/analysis tool?

Since we have 8 or so vCenters, we would like to use vCOPs to generate the alert actions for many of the standard vcenter alerts. Is this an appropriate thing to ask vCOPs to do? It seems much better to have one monitoring/alerting tool do this, then trying to be sure all the vcenters have commonly (and correctly) setup snmp and alerts thresholds and actions.

Your opinion please!

[mark_j]

vC Ops can't alert on 100% of the potential conditions that vCenter actions can be configured for. The criteria for defining alerts differs between vC Ops and vCenter. vCenter has the leg-up on interpreting certain events (non-condition) alerts, however OOTB vC Ops can interpret some. If you can identify any that are not interpreted, you can add them to the Faults/events config file on the VMware adapter (see /conf and the VMware adapter manual)). If you can make it work with vC Ops, though, I would do it and avoid the extended vCenter action configuration.

[TedH256]

OK will have to look into it more deeply, thank you for the suggestion of looking at the config file on the vmware adapter!

We have been looking to standardize the alerting across all our vcenters, and just saw a demo from our networking department of the IBM ITM product - it connects to vcenter and really neatly exposes all the metrics that vcenter has to offer, and allows SNMP traps to be sent on whatever you want. Easy to configure, easy to apply to multiple vcenter instances, etc ....

I was wondering whether we could do the same with vCOPs ..

[TedH256]

mark.j wrote:

vC Ops can't alert on 100% of the potential conditions that vCenter actions can be configured for. The criteria for defining alerts differs between vC Ops and vCenter. vCenter has the leg-up on interpreting certain events (non-condition) alerts, however OOTB vC Ops can interpret some. If you can identify any that are not interpreted, you can add them to the Faults/events config file on the VMware adapter (see /conf and the VMware adapter manual)). If you can make it work with vC Ops, though, I would do it and avoid the extended vCenter action configuration.

Mark J

I'm not exactly sure what you mean by "vCenter has the leg-up on interpreting certain events (non-condition) alerts, however OOTB vC Ops can interpret some. If you can identify any that are not interpreted ..." specifically the "interpreting certain events (non-condition) alerts" part.

What is a non-condition event? By "not interpreted" does that mean -- vCOPs has the event/condition information, but simply has no decode for it (sort of like WireShark not having a decode for some odd protocol)?

[mark_j]

I don't have a list offhand of what you're asking as that'd be a manual process to make that list.

When I said "intepreted" I mean the events are captured from vCenter.. think the "events" tab in vCenter. Whereas a "condition" is something that vCenter is always evaluating for a specific criteria from some particular resource or property. The decode description is about right.. if the event isn't identified as a Fault, it'll let it go and not flag it. At a certain point you'd start considering integrating Log Insight to parse all the syslog and logs, as you certainly don't want to capture EVERY SINGLE event from vCenter using vC Ops specifically.

[mark_j]

vC Ops can certainly use SNMP traps to forward events/alerts to 3rd party/additional systems. We do that whenever you want integration for purposes of automation or ticketing. If you're looking for something that integrates with vCenter, vC Ops is going to do that (getting data form vCenter is it's core competency besides being an analytics engine).

[TedH256]

Thank you --

I've played around a bit with vCOPs but not much with it's alerting capabilities - it seemed so easy to do in the IBM ITM tool, and I can't remember a similarly clean interface in vCOPs for finding the metrics that match the alert capabilities in vCenter.

Plus - I've "heard" that vCOPs is not particularly strong as an alerting tool - but maybe for vCenter related stats/events/conditions it would be an effective tool.

Thank you again ...

[mark_j]

It's actually extremely powerful as an alerting tool. You need to use the Custom UI's capabilities to get very granular alerts, as the vSphere UI's alerts are rather basic.

[TedH256]

ok - have to dig in, thank you

[mlebied]

We have experimented with the inbound alert handling within vCops, using SNMP and vCenter alerts. The functionality is basis, but does not meet our longer term needs to alert enrichment, correlation, and auto-ticketing to our ITSM system. We are currently investigating the use of general event handlers in vCO with workflows designed to enrich a received alert with information from our CMDB. The goal is to provide deeper insight to the alert instead of just the raw alert payload.

Is anyone else using vCO for this purpose?

[TedH256]

mlebied wrote:

We have experimented with the inbound alert handling within vCops, using SNMP and vCenter alerts. The functionality is basis, but does not meet our longer term needs to alert enrichment, correlation, and auto-ticketing to our ITSM system. We are currently investigating the use of general event handlers in vCO with workflows designed to enrich a received alert with information from our CMDB. The goal is to provide deeper insight to the alert instead of just the raw alert payload.

Is anyone else using vCO for this purpose?

What do you mean by "the inbound alert handling within vCops, using SNMP and vCenter alerts"? Do you mean you tried configuring vCenter alerts to send SNMP traps to vCOPs?

vCOPs has access to all the data that vCenter does - so the "alerting" should be FROM vCOPs, which can then be configured to send an SNMP trap to your ITSM/Ticketing system. Am I missing something?

And the second part of what you are trying to do - lol! - I also don't really understand. What is vCO?

[mlebied · Accepted solution]

vCO = vCenter Orchestrator

Yes. We have found that configuring alert handling in vcOps is cumbersome. The virtual appliance provided by PSO makes the process a little easier with a UI front-end, but it really should be as easy as configuring alerts in the vSphere UI

[TedH256]

There is a virtual appliance, other than the standard UI and Analytics vms that are part of the vAPP? What does it do? How do you get it?

I'm fairly new to both vCOPs and management/monitoring tools in general so excuse me if my questions seem too newbie'ish.

So I guess you did not really mean "incoming snmp" to vCOPs but just simply trying to configure the regular vCenter -type alerts using vCOPs - and found the interface clumsy? Working from the custom UI? What about it was clumsy? I know that in ITM there is just a list of all the metrics/events/conditions that vCenter tracks, and you can simply pick from the list and build your alert from there. Does vCOPs not have a similar presentation?