How to create vCenter Down Alerts in VMware Aria Operations by Eliminating False-Positive

Products

• VCF Operations
• VMware Aria Operations (formerly vRealize Operations) 8.x

Issue/Introduction

Administrators frequently encounter "False Positive" vCenter Down alerts in VMware Aria Operations. These alerts often trigger when the vCenter Server is physically operational, but the connection between Aria Operations and the vCenter has been interrupted. This typically occurs due to:

• Expired service account passwords.

• Incorrect credential configurations.

• Minor network communication blips between the adapter and the target.

The requirement is to generate alerts only when the vCenter appliance is actually down or unreachable, rather than when there is a simple authentication or collection failure.

Environment

Aria Operations 8.18.x
VCF Operations 9.x

Cause

By default, many environments rely on the Adapter Instance health. The "Adapter Instance Down" alert is designed to trigger whenever the management pack cannot collect data. Because a failed login (due to credential issues) prevents data collection, the system reports this as an "instance down" event, even if the vCenter Server itself is healthy and running.

Resolution

To achieve genuine alerting, you must shift your monitoring strategy from Adapter Instance health to the Object Availability of the vCenter Server itself.

Step 1: Create a New Symptom Definition

This symptom focuses on the actual reachability of the vCenter object rather than the status of the login credentials.

1. Ensure the SDDC Health Monitoring Management Pack is installed via Data Sources > Integrations > Repository.

2. Navigate to Configure > Alerts > Symptom Definitions and click Add.

3. Select vCenter Server as the Base Object Type.

4. Define the following condition:

   • Metric: System | Availability (or Summary | Running State)

   • Condition: is less than 1 (Note: 1 = Up, 0 = Down).

   • Wait Cycle: Set to 3. This acts as a dampener to ensure the alert only triggers if the vCenter remains unreachable for three consecutive collection cycles.

Step 2: Create a Specific Alert Definition

1. Navigate to Configure > Alerts > Alert Definitions and click Add.

2. Name: vCenter Server is Down.

3. Base Object Type: vCenter Server.

4. Symptoms: Drag and drop the "System Availability is less than 1" symptom created in Step 1.

5. Criticality: Set to Critical or Immediate.

Step 3: Deactivate Default Adapter Alerts (Crucial)

To stop the false positives, you must disable the noise-generating alerts in your active policy.

1. Go to Configure > Policies and edit your Active Policy.

2. Under the Alerts and Symptoms tab, search for and Deactivate the following:

   • Adapter instance is down

   • Objects are not receiving data from adapter instance

3. Click Save.

Additional Information

With this configuration, if a password expires, the "Adapter Instance" will show a collection error in the UI, but no Critical Alert will be sent to your team. An alert will only trigger if the System | Availability metric drops to 0, confirming the vCenter is genuinely unreachable.