Deleting an alert definition in Aria Operations

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Alerts get triggered post disabling the alert definition.

Log traces for alert generation:

analytics-########-####-####-####-############.log

yyyy-mm-ddThh:mm:ss WARN  [ServerConnection on port 10000 Thread 1492]  com.vmware.vcops.controller.retriever.AlertDefinitionServiceImpl.preProcessUpdate - Updating adapter-defined Alert Definition:<Alert_Definition_Name>
yyyy-mm-ddThh:mm:ss INFO  [KvStoreNotification--thread-1]  com.vmware.vcops.analytics.policy.PolicyCache.getPolicyElementType_aroundBody20 - Alert definition update: id= AlertDefinition-VMWARE-########-####-####-####-############, type=UPDATED, updateCount=1
yyyy-mm-ddThh:mm:ss ERROR [ServerConnection on port 10000 Thread 1494]  com.vmware.vcops.controller.data.utils.action.VMwareActionsExpressionValuesCache.getMetricValue - No MetricValue was obtained for resourceId=########-####-####-####-############ and attributeKey=summary|config|type.
yyyy-mm-ddThh:mm:ss ERROR [ServerConnection on port 10000 Thread 1494]  com.vmware.vcops.controller.data.utils.action.ResourceExpressionObjectCache.attribute - Unable to get metric value for attributeKey=summary|config|type and resourceId=########-####-####-####-############
yyyy-mm-ddThh:mm:ss INFORMATION [ResourceLoader]  com.integrien.alive.dbaccess.AnalyticsDBUtil.loadResourceCachesT - Preloaded ## resources.
yyyy-mm-ddThh:mm:ss ERROR [ServerConnection on port 10000 Thread 1492]  com.vmware.vcops.controller.data.utils.action.VMwareActionsExpressionValuesCache.getMetricValue - No MetricValue was obtained for resourceId=########-####-####-####-############ and attributeKey=summary|config|type.
yyyy-mm-ddThh:mm:ss ERROR [ServerConnection on port 10000 Thread 1492]  com.vmware.vcops.controller.data.utils.action.ResourceExpressionObjectCache.attribute - Unable to get metric value for attributeKey=summary|config|type and resourceId=########-####-####-####-############
yyyy-mm-ddThh:mm:ss INFO  [NonExistingResourceDeletion--thread-1]  com.integrien.alive.controller.persistence.ResourceDeletion.ResourceRelationshipCleanup.run - Skipped to let run the leader node only.

analytics.audit.log

yyyy-mm-ddThh:mm:ss WARN  [ServerConnection on port 10000 Thread 1895]  com.vmware.vcops.controller.retriever.AlertDefinitionServiceImpl.preProcessUpdate - Updating adapter-defined Alert Definition: <Alert_Definition_Name>
yyyy-mm-ddThh:mm:ss WARN  [ServerConnection on port 10000 Thread 1895]  com.vmware.statsplatform.persistence.global.UserDataService.createOrUpdateAlertDefinition - Clobbering the user modified definition AlertDefinition-VMWARE-########-####-####-####-############ with a pristine one
yyyy-mm-ddThh:mm:ss INFO  [KvStoreNotification--thread-1]  com.vmware.vcops.analytics.policy.PolicyCache.getPolicyElementType_aroundBody20 - Alert definition update: id= AlertDefinition-VMWARE-########-####-####-####-############, type=UPDATED, updateCount=1
yyyy-mm-ddThh:mm:ss INFORMATION [ResourceLoader]  com.integrien.alive.dbaccess.AnalyticsDBUtil.loadResourceCachesT - Preloaded ## resources.
yyyy-mm-ddThh:mm:ss INFO  [NonExistingResourceDeletion--thread-1]  com.integrien.alive.controller.persistence.ResourceDeletion.ResourceRelationshipCleanup.run - Skipped to let run the leader node only.
    
yyyy-mm-ddThh:mm:ss WARN  [ServerConnection on port 10000 Thread 3093]  com.vmware.vcops.controller.retriever.AlertDefinitionServiceImpl.preProcessUpdate - Updating adapter-defined Alert Definition:<Alert_Definition_Name>
yyyy-mm-ddThh:mm:ss WARN  [ServerConnection on port 10000 Thread 3093]  com.vmware.statsplatform.persistence.global.UserDataService.createOrUpdateAlertDefinition - Clobbering the user modified definition AlertDefinition-VMWARE-########-####-####-####-############ with a pristine one
yyyy-mm-ddThh:mm:ss INFO  [KvStoreNotification--thread-1]  com.vmware.vcops.analytics.policy.PolicyCache.getPolicyElementType_aroundBody20 - Alert definition update: id= AlertDefinition-VMWARE-########-####-####-####-############, type=UPDATED, updateCount=1
yyyy-mm-ddThh:mm:ss INFO  [KvStoreNotification--thread-1]  com.vmware.vcops.analytics.policy.PolicyCache.reportDBUpdate_aroundBody18 - Policy update: id=Policy.########-####-####-####-############, type=UPDATED

Environment

Aria Operations 8.x

Cause

Cache issue on Aria Operations prevents the policy from being updated.

Resolution

1. Disable the Alert via Policy: Follow the steps outlined in the related Broadcom Knowledge Base (KB) article for disabling alerts:

Alert continues to trigger even though Alert Definition is deactivated in policy of Aria Operations (386790)

2. If the alert continues to trigger after following the above KB article (386790), you may proceed to delete the alert definition as mentioned below.

IMPORTANT: Strongly recommended to export the alert definition before deleting it. Proceed with either of one method mentioned below for exporting an alert definition:

Method 1: Using Content Management

Log in to the Aria Operations UI as an administrator.
Navigate to Administration > Control Panel > Content Management.
Click the Export tab.
Select Alert Definitions from the list.
Click the Export button to download the XML file.

Method 2: From the Alert Definitions Page

Navigate to the Alert Definitions page (typically found under Configure > Alerts).
Locate the specific alert definition you want to export.
Click the ellipsis (...) button (or the "Actions" column) for that alert.
Select Export from the dropdown menu.
The alert definition will download as an XML file.

3. Post exporting the alert definition successfully proceed further with deleting the Alert Definition. The process involves two steps, first deactivating the alert in the relevant policy and then deleting the definition itself.

a. Deactivate the Alert in the Policy:

- Go to Configuration > Policy Definitions.
- Select the policy where the alert is active and click Edit.
- Navigate to the Alerts and Symptoms section.
- Find the specific alert definition in the list.
- Change its state to Deactivated.
- Click Save to apply the policy changes.

b. Delete the Alert Definition:

- Navigate to Configure > Alerts > Alert Definitions.
- Select the alert definition you wish to permanently remove.
- Click the horizontal ellipsis (...) in the toolbar, and choose Delete.

Additional Information

References: