Alert configured in Aria Operations for Logs to forward to Aria Operations is not working
Article ID: 384207
Updated On:
Products
Issue/Introduction
Case Scenario:
1. In Aria Operations for Logs, the alert is configured to Forward to VMware Aria Operations with a fallback object selected.
2. The test alert is sent to email and shows up on the Alert page under the fallback object in Aria Operations with no issue.
3. When the alert actually triggers, the alert is sent to the email, but not listed on the Alert page under the fallback object in Aria Operations.
4. In situations where the test alert is clicked from Aria Operations for Logs but nothing is found in Aria Operations and no more alerts are being sent at all, it could be a cluster issue in Aria Operations. You can try Shutdown and Startup sequence for Aria Operations cluster to try and resolve if the cluster appears to already be in a functional state.
In Aria Operations for Logs, the vrops_integration.log may have an entry like below where ##.##.##.### is an Aria Operations for Logs node IP address:
[2025-02-27 17:15:14.658+0000] ["application-akka.actor.default-dispatcher-11"/##.##.##.### INFO] [com.vmware.loginsight.vropssuite.VropsSuiteApiRequest] [Post event for resource ########-####-####-####-############ : "VMware Aria Operations for Logs: This is a test notification for alert \"New VM Created 3\".", INFORMATION ][2025-02-27 17:15:14.658+0000] ["application-akka.actor.default-dispatcher-11"/##.##.##.### INFO] [com.vmware.loginsight.vropssuite.VropsSuiteApiRequest] [constructed json {"eventType":"NOTIFICATION","resourceId":"########-####-####-####-############","startTimeUTC":1740676514658,"cancelTimeUTC":"0","message":"\"VMware Aria Operations for Logs: This is a test notification for alert \\\"New VM Created 3\\\".\"","severity":"INFORMATION","managedExternally":"true"}][2025-02-27 17:15:14.722+0000] ["application-akka.actor.default-dispatcher-11"/##.##.##.### INFO] [com.vmware.loginsight.vropssuite.VropsSuiteApiRequest] [Open connection to URL https://<vrops_fqdn>/suite-api/api/events]
In Aria Operations for Logs the runtime.log may have an entry like below showing the event was successfully sent due to Response Code 200:[2025-02-27 17:15:14.722+0000] ["application-akka.actor.default-dispatcher-11"/##.##.##.### INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Sending 'POST' request to URL : https://<vrops_fqdn>/suite-api/api/events][2025-02-27 17:15:14.758+0000] ["application-akka.actor.default-dispatcher-11"/##.##.##.### INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Response Code : 200][2025-02-27 17:15:14.758+0000] ["application-akka.actor.default-dispatcher-11"/##.##.##.### INFO] [com.vmware.loginsight.commons.security.UrlConnectionManager] [Processed POST request to https://<vrops_fqdn>/suite-api/api/event
In the Aria Operations log http_api.log, you may have an entry like below (you do not see any errors in the analytics*.log):
2025-02-27T17:15:14,756+0000 INFO [ajp-nio-127.0.0.1-8010-exec-1, iENd6tmnfzOqhNlgdkaKtnpcOgctDVWi] utils.HttpRequestLogger - After request [POST /suite-api/api/events, client=<aria_ops_node_IP_address>, payload={"eventType":"NOTIFICATION","resourceId":"########-####-####-####-############","startTimeUTC":1740676514658,"cancelTimeUTC":"0","message":"\"VMware Aria Operations for Logs: This is a test notification for alert \\\"New VM Created 3\\\".\"","severity":"INFORMATION","managedExternally":"true"}]
Environment
Aria Operations for Logs 8.18.x
Aria Operations 8.18.x
Cause
Alerts only show on the Alert page under the fallback object in Aria Operations if a matching object is NOT found.
In cases where alerting is not showing up at all in Aria Operations when it worked before, there could be something stuck in the cluster like the queue being full or some other inconsistency. This could likely be resolved with a cluster restart - Shutdown and Startup sequence for Aria Operations cluster.
Resolution
1. Make sure the alert is triggered, and a notification is sent to the email. For example:
2. Locate the object (examplehost.com in the above example) presented in the email alert.
3. Go to Aria Operations UI, locate the object examplehost.com, if this object exists in Aria Operations, then the alert will show under this object's Alert page in Aria Operations. For example:
4. If the above examplehost.com is NOT found in Aria Operations. The alert will land on the Alert page of the fallback object configured in Aria Logs.
See Additional Information below if the above does not apply.
Additional Information
Additional possible resolution is to restart the Aria Operations cluster following Shutdown and Startup sequence for Aria Operations cluster if your issue is like scenario #4 above.
Feedback
