How do I get the vcenter name in alert emails

Hey ya'll,  I am using alerts triggered by VMware Triggered Alarm to find hardware issues on our VMware Hosts.  I have the alert working but would LOVE to be able to insert the variable for the vcenter name into the email.


Unfortunately the only place I can find the vcenter name is in the Orion.VIM.VirtualDisks table.


Is there a way to Join enough tables so that I can get the vcenter name in the email alerts.

  • Hello! Wave

    I'd love to take a crack at this! Do you mind sharing your alert Trigger Condition page, if possible? That will let me know what you're already working with and what conditions you're looking to alert on. Feel free to PM me on thwack if you don't feel comfortable posting on this post.

  • I did some initial testing in my lab with a dummy alert I set up. Please add this to your e-mail message body:

    ${N=SWQL;M=SELECT VCenterName
    FROM Orion.VIM.VirtualDisks
    WHERE VirtualMachineID = ${N=SwisEntity;M=VirtualMachine.VirtualMachineID}}

    That should pull the VCenterName record from the Orion.VIM.VirtualDisks table you provided based off of the dynamic VirtualMachineID of the VM that triggered the alert.

    Please let me know if that works for you. If not, I'll gladly revisit. Thumbsup

  • Hey Adam,  I did try your code but it only brings the IP address up.  Are you actually getting the name or just the IP?

    SELECT E0.[DisplayName],
    FROM Cortex.Orion.Virtualization.TriggeredAlarmState AS E0
    WHERE ( ( ( E0.[Alarm].[Name] LIKE '%vmnic%' ) AND ( E0.[Host].[Status] != '1' ) ) )
  •  Hey Adam - I hadn't looked at the cortex entities. That clued me in. I also agree that the vm triggered alert condition is a new entity also. 

    I was able to get the following to work, I added both the name and displayname. The name returned only the IP address for me also. The displayname gave the actual name. The where condition is stripped down as I wanted enough data to work with. 

    SELECT E0.[DisplayName],, E0.Host.DataCenter.VCenter.DisplayName AS [Vcenter Name] FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0 WHERE ( E0.[Host].[Status] != '1' )
  • Looks good! So nice when you throw something out at the end of a shift, come back and it's sorted

    Marc's got the right datapoint below, displayname rather than name

    For production purposes i'd reccomend changing the where condition to stick an ID macro in, but then it's pretty much done

    and then maybe could make it standard maybe somehow

  • I wish! Best way to make this a standard in the product is the feature request. That said, I have added this to my collection of "great ideas from Thwacksters" to share with future customers with the same need. Slight smile

    I'd love to see an example of the final output email (appropriately redacted screenshot of course) to tie a nice bow on the whole process. 

  • ${N=SwisEntity;M=Host.HostID}${N=SWQL;M=SELECT

    FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0

    WHERE ${N=SwisEntity;M=Host.HostID}}

  • Hate to say it didn't work but..  it didn't work.  :-)

    Here is a picture where I configured the message.

    Then this is what I get in the email.

    I know we are getting closer!!!

  • ${N=SWQL;M=SELECT E0.Host.DataCenter.VCenter.displayname
    FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0
    WHERE E0.relatedhost =  ${N=SwisEntity;M=Host.HostID}}

    Bad multiple things - edited the query above. And multitasking is bad.... Just say no to it. 

  • Sorry that still didn't work.  I even used this query in SWQL studio and it does work.

    SELECT E0.Host.DataCenter.VCenter.DisplayName FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0
    But I added it to the Insert Variable
    But those just come back blank in the emails.
  • Hi Rachel,

    Taking a quick look again in downtime ( it takes an age to populate the variables list, i'm sure there's something poorly optimized happening there)

    These should work OOTB, but doesnt look like they do to me.:

    ${N=SwisEntity;M=DataCenter.VCenter.Name} ${N=SwisEntity;M=DataCenter.VCenter.Description}

    That said it's all about the object you pass in and it's relationship to the rest of the data. These OOTB macros look like they're for an entity one under a datacenter, so probably a cluster alarm. Might be that a small edit would resolve, say: 

    ${N=SwisEntity;M=Cluster.DataCenter.VCenter.Name} ${N=SwisEntity;M=Cluster.DataCenter.VCenter.Description}

    or another rank for host maybe. Point being that I think the search through the macros bit might have stopped a bit early looking at the screenshots above, you'll find better options setting "show variables for" to the object you're working with and "group by" to category.

    Anyway in the Custom SWQL path, worth noting that between Marc and your examples there may be a missed bit of context:

    When me and Marc are talking about this bit  ${N=SwisEntity;M=Host.HostID} that's a macro in a macro, where the point of that is to select the one relevant bit of information from the table containing the thing you care about. So often if you're building a custom SWQL or SQL macro you need to put an ID macro in for production, and test in SWQL studio using an actual ID (because the macro wont resolve there, having not got an object going in etc)

    Somethng like this works in SWQL (which is the same as before, but i've added a case statement so it fails more gracefully:

    SELECT TOP 1 CASE WHEN IS NULL THEN 'No Vcenter Found' else end as output FROM Cortex.Orion.Virtualization.TriggeredAlarmState AS E0 --where e0.Id = 14101159

    Note the ID commented out for testing
    Now to make that live i'd have to find some macro or two that produces a relevant ID:

    That looks like a pain, no ID macro, annoying (possibly editing a macro as above resolves that)
    Name and Timestamp might work though.

    Putting this together, this seems to work
    TOP 1
    WHEN IS NULL THEN 'No Vcenter Found'
    end as output
    FROM Cortex.Orion.Virtualization.TriggeredAlarmState AS E0
    where e0.DisplayName like '${N=SwisEntity;M=DisplayName}'
    order by e0.Timestamp desc}

    Note here i'm not matching the timestamp, which is probably not ideal, and maybe you'd get something weird in the event of quick flaps, but i'm sure someone can continue work on it if need be.
  • I got this from marcrobinson and it actually works!!!

    ${N=SWQL;M=SELECT E0.Host.DataCenter.VCenter.displayname

    FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0

    WHERE E0.relatedhost = ${N=SwisEntity;M=Host.HostID}}


    I really appreciate all ya'lls help!!!

Reply Children