"The password for user admin has expired" Notification Event Triggered Instead of Alert

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Instead of alert being generated, a notification event is triggered in VMware Aria Operations for the symptom "The password for user admin has expired".

Cause

This behavior is specific to the "Password is about to expire" alert. The default target resource for this alert is the NSX Adapter instance. When the event message's target entity is a Transport Node object instead of an NSX Adapter instance object, the standard alert logic is bypassed, and the system falls back to generating a notification event.

Resolution

User needs to define the corresponding symptoms and alerts on Transport Node. Here are the steps.

Note: The following guide is for the NSX alert "User password is about to expire.". For other alarm types, need to change the message event regex accordingly:

Alarm	Regex
User password has expired.	The password for user (?s).* has expired.(?s).*
User password is approaching expiration.	The password for user (?s).* is approaching expiration in (?s).* days.(?s).*
User password is about to expire.	The password for user (?s).* is about to expire in (?s).* days.(?s).*

 

1. Define a symptom.

In Operations > Configuration > Symptom Definitions, select Message Event, and click ADD:

• Base Object Type should be Transport Node.
• Type of Event should be Notification.
• Condition is Matches regular expression.
• Regex expression is The password for user (?s).* is about to expire in (?s).* days.(?s).*
• Criticality is Immediate.
• Then save.

2. Define an alert.

In Operations > Configuration > Alert Definitions, click ADD.

Choose the object type as Transport Node, and set criticality as Immediate.

In the second step, at the right panel choose "Symptoms" and specify the "Select Symptom" as Message Event. Use the search bar to locate the symptom defined in step 1, and drag it to the left panel.

In the third step, create a new recommendation and find an existing recommendation, and then drag it to the left panel.

Finally, choose the policy where this alert needs to be activated (IMPORTANT! Otherwise the alert will be deactivated). Then click SAVE.

3. Wait for a collection cycle or two, an alert will be generated (in orange color).