Validating a vCenter alarm

Products

• VMware vSphere ESXi

Issue/Introduction

Labels created on custom vCenter server alarms can be misleading.

For example, an alarm is created for the VmDisconnectedEvent and is labeled 'VM Lost Network Connectivity'. When performing ESXi patching, each host disconnects from vCenter during the operation. This alert will trigger for every VM indicating they lost network connectivity, yet monitoring products like Solar Winds or Data Dog will show no uptime issues for the virtual machine.

[vim.event.AlarmStatusChangedEvent] [info] [] [EXAMPLE] [105719366] [Alarm 'VM Lost Network Connectivity' on ESX-HOST changed from Green to Red]

Environment

vSphere

Cause

The VM Disconnected event is an alert to say vCenter is unable to retrieve the status of a VM. If the host is disconnected from vCenter the VM will be as well. This does not indicate the VM was not available on the network. 

Resolution

Validate the alarms you see using the journalctl log in vCenter to find your event alarms by searching for AlarmStatusChangedEvent, or the name of the object the alarm is triggered by. From this you can find the actual vim.event.type for the event and validate if it means what the alarm label indicates.

journalctl -b -0 | less