How to Exclude entries from "vm.heartbeat.latest:0" results

Hi Martin,

there are several ways to bypass alerting for particular VMs. The only problem is to distinguish VMs that should be excluded.

1) it's possible to exclude VMs from the alert by using their name. The solution is suitable when you want to exclude just several VMs. Example:

• vm.origin:vmware AND NOT vm.toolsStatus:toolsok -vm.name:"VM_test*" -vm.name:"VM001"

2) if the VMs are in a folder then you can use vm.folder attribute.

Example:

• vm.origin:vmware AND NOT vm.toolsStatus:toolsok -vm.folder.name:"Linux Machines"

3) you can also use Labels in VMAN. For further details see another Thwack thread. In VMAN Admin guide (Virtualization Manager Administrator Guide : Custom Labels) you can read more about labels.

Thanks for the clear response Milan

I tried the second option - on the dashboard, after clicking through to the alert, I selected the "Configure" option at the bottom. On the first page, I then entered the code you wrote in the example;

vm.origin:vmware AND NOT vm.toolsStatus:toolsok -vm.folder.name:"Linux Machines"

Unfortunately, that opened up a new can of worms! I then had most of my VM's listed, stating that VMTools was needing attention (out of date on most VM's as we have just upgraded to vCentre 5.1 from 4.1) - I changed it back to default and now have just the Linux VM's listed again which is visually less alarming!

I assume this is because your suggested script is looking for VMTools not reporting as OK, which in my case they are not. So this is expected behaviour. I will use this script once we have updated VMTools on all our VM's but that is likely to take some weeks, or even months.

I suppose my options in the short term are excluding individual VM's or using labels in VMAN.

Thanks again

Sorry for misleading you. The examples were intended to give you a hint focusing on the text in bold.

FYI the query mentioned above is copied from "VMs with Bad Tools" alert which is included in every VMAN: