Virtual Machine Alert Definitions

The vCenter adapter provides alert definitions that generate alerts on the virtual machine objects in your environment.

Health/Symptom-Based

These alert definitions have the following impact and criticality information.

Impact: Health

Criticality: Symptom-based

Alert Definition	Symptom	Recommendations
Virtual machine is experiencing memory compression, ballooning or swapping due to memory limit.	Virtual machine memory limit is set AND Virtual machine memory demand exceeds configured memory limit AND [Virtual machine memory is compressed OR Virtual machine is using swap OR Virtual machine memory ballooning is at warning/immediate/critical level] AND Recommended virtual machine memory size	Increase the memory limit for the virtual machine to match the recommended memory size. Alternatively, remove memory limit for the virtual machine.
Virtual machine has CPU contention caused by IO wait.	Virtual machine CPU I/O wait is at warning/immediate/critical level.	Increase the datastore I/O capacity for the connected data stores to reduce CPU I/O wait on the virtual machine.
Virtual machine has unexpected high memory workload.	Symptoms include all of the following: Virtual machine memory workload is at Warning/Immediate/Critical level Anomaly is starting to/moderately/critically high	Check the guest applications to determine whether high memory workload is an expected behavior. Add more memory for this virtual machine.
Virtual machine has memory contention due to swap wait and high disk read latency.	Symptoms include all of the following: Virtual machine CPU swap wait is at warning/immediate/critical level (5/10/15) Virtual machine has read latency at warning level Recommended virtual machine memory size	Add more memory for this virtual machine.
Virtual machine has memory contention due to memory compression, ballooning or swapping.	! Virtual machine memory limit is set AND Virtual machine has memory contention at warning/immediate/critical level AN [ Virtual machine memory ballooning at warning/immediate/critical level OR Virtual machine memory is compressed OR Virtual machine is using swap]	Add memory reservations to this virtual machine to prevent ballooning and swapping. Use vSphere vMotion to migrate this virtual machine to a different host or cluster.
Virtual machine has disk I/O read latency problem.	Symptoms include all of the following: Virtual machine disk read latency at Warning /Immediate/Critical level Virtual machine disk read latency above DT Virtual machine has low co-stop Virtual machine has low CPU swap wait	Check whether you have enabled Storage IO control on the datastores connected to the virtual machine. Increase IOPS for the datastores connected to the virtual machine. Use vSphere Storage vMotion to migrate this virtual machine to a different datastore with higher IOPS.
Virtual machine has disk I/O write latency problem.	Symptoms include all of the following: Virtual machine disk write latency at Warning/ Immediate/Critical level Virtual machine disk write latency above DT Virtual machine has low CPU swap wait (< 3 ms)	Check whether you have enabled Storage IO Control on the data stores connected to the datastore. Increase IOPS for the data stores connected to the virtual machine. If the virtual machine has multiple snapshots, delete the older snapshots. Use vSphere Storage vMotion to migrate some virtual machines to a different datastore.
Virtual machine has disk I/O latency problem caused by snapshots.	Symptoms include all of the following: Virtual machine CPU I/O wait is at warning/immediate/critical level Virtual machine has at least one snapshot All child datastores have [ ! Disk command latency at warning level ]	If the virtual machine has multiple snapshots, delete the older snapshots. Reduce the number of snapshots by consolidating the snapshots into one snapshot. In vSphere Client , select the VM, right-click, select Snapshot , and then Consolidate .
Not enough resources for vSphere HA to start the virtual machine.	Not enough resources for vSphere HA to start VM (Fault symptom).	If virtual machine CPU reservation is set, decrease the CPU reservation configuration. If virtual machine memory reservation is set, decrease the memory reservation configuration. Add more hosts to cluster. Bring any failed hosts online or resolve a network partition, if one exists. If DRS is in manual mode, look for pending recommendations and approve the recommendations so that vSphere HA failover can proceed.
The Fault tolerance state of the virtual machine has changed to "Disabled" state.	VM fault tolerance state changed to disabled (Fault symptom).	Enable the secondary virtual machine indicated in the alert.
vSphere HA failed to restart a network isolated virtual machine.	vSphere HA failed to restart a network isolated virtual machine (Fault symptom).	Manually power on the virtual machine.
The fault tolerance state of the virtual machine has changed to "Needs Secondary" state.	VM Fault Tolerance state changed to needs secondary (Fault symptom).	Keep HA enabled when Fault tolerance (FT) is required to protect virtual machines.
vSphere HA cannot perform a failover operation for the virtual machine	vSphere HA virtual machine failover unsuccessful (Fault symptom)	If the error information reports that a file is locked, the virtual machine might be powered on a host that the vSphere HA primary agent can no longer monitor by using the management network or heartbeat datastores. The virtual machine might have been powered on by a user on a host outside of the cluster. If any hosts are declared offline, determine whether a networking or storage problem caused the situation. If the error information reports that the virtual machine is in an invalid state, an in-progress operation might be preventing access to the virtual machine files. Determine whether any operations are in progress, such as a clone operation that is taking a long time to complete. You can also try to power on the virtual machine and investigate any returned errors.
One or more virtual machine guest file systems are running out of disk space.	Symptoms include all of the following: Guest file system usage at warning level Guest file system usage at critical level	Add a new virtual hard disk or expand the existing disk of the virtual machine. Before expanding the existing disk, remove all the snapshots. Once done, use a guest OS specific procedure to expand the file system on the new or expanded disk.
Virtual machine has CPU contention due to memory page swapping in the host.	Symptoms include all of the following: Virtual machine CPU swap wait is at Critical level Virtual machine CPU swap wait is at Immediate level Virtual machine CPU swap wait is at Warning level	Set memory reservations for the virtual machine to prevent its memory from being swapped. Verify that VMware Tools is installed and running, and that the balloon driver is enabled in the guest. Memory ballooning helps the host reclaim unused memory from the guest more effectively, and might avoid swapping. Use vMotion to migrate this virtual machine to a different host or cluster.

Efficiency/Warning

These alert definitions have the following impact and criticality information.

Impact: Efficiency

Criticality: Warning

Alert Definition	Symptom	Recommendations
Virtual machine is idle.	Symptoms include all of the following: Virtual machine is idle Virtual machine high ready time on each vCPU ! Virtual machine is powered off	Power off this virtual machine to allow for other virtual machines to use CPU and memory that this virtual machine is wasting.

Risk/Symptom-Based

These alert definitions have the following impact and criticality information.

Impact: Risk

Criticality: Symptom-based

Alert Definition	Symptom	Recommendations
Virtual machine has CPU contention caused by co-stop.	Symptoms include all of the following: Virtual machine CPU co-stop at warning/immediate/critical level ! Virtual machine is powered off Number of vCPUs to remove from virtual machine	Review the symptoms listed and remove the number of vCPUs from the virtual machine as recommended by the symptom.
Virtual machine is violating vSphere 5.5 hardening guide.	Unrestricted VM-to-VM communication through VMCI OR VMsafe CPU/Memory APIs-port number configured OR Dvfilter network API enabled OR Non-compliant max VMX file size OR Non-compliant max VM log file size OR Allow unauthorized modification of device settings OR Allow unauthorized connect and disconnect of devices OR Tools auto install not disabled OR Non-compliant max number of remote console connections OR Allow VM to obtain detailed information about the physical host OR Non-compliant max VM log file count OR Feature not exposed in vSphere: MemsFss is not disabled OR VMsafe CPU/memory API enabled OR Parallel port connected OR Console drag and drop operation not disabled OR Console copy operation not disabled OR Serial port connected OR Feature not exposed in vSPhere: AutoLogon is not disabled OR Use independent non persistent disk OR Feature not exposed in vSphere: UnityPush is not disabled OR Shrink virtual disk not disabled - diskShrink OR Feature not exposed in vSphere: GetCreds is not disabled OR CD-ROM connected OR Feature not exposed in vSPhere: HGFSServerSet is not disabled OR Console paste operation not disabled OR Feature not exposed in vSPhere: BIOSBBS is not disabled OR Shrink virtual disk not disabled - diskWiper OR USB controller connected OR Feature not exposed in vSPhere: Monitor Control is not disabled OR Floppy drive connected OR Feature not exposed in vSphere: LaunchMenu is not disabled OR Versionget is not disabled OR Feature not exposed in vSphere: Toporequest is not disabled OR Feature not exposed in vSphere: Unity-interlock not disabled OR VM logging is not disabled OR Feature not exposed in vSphere: Unity is not disabled OR Feature not exposed in vSphere: Trashfolderstate is not disabled OR VGA only mode is not enabled OR Feature not exposed in vSphere: Trayicon is not disabled OR Feature not exposed in vSphere: Unity-Taskbar is not disabled OR Feature not exposed in vSphere: Versionset is not disabled OR VM console access via VNC protocol is not disabled OR Feature not exposed in vSphere: Protocolhandler is not disabled OR VIX message is not disabled OR Feature not exposed in vSphere: Shellaction is not disabled OR 3D features is not disabled OR Feature not exposed in vSphere: Unity-Windowcontents is not disabled OR Feature not exposed in vSphere: Unity-Unityactive is not disabled	Fix the vSphere 5.5 hardening guide rule violations according to the recommendations in the vSphere Hardening Guide (XLSX).
Virtual machine has CPU contention due to multi-vCPU scheduling issues (co-stop) caused by snapshots	Symptoms include all of the following: Virtual machine CPU co-stop is at Warning level OR Virtual machine CPU co-stop is at Immediate level OR Virtual machine CPU co-stop is at Critical level And Virtual machine is powered off OR Virtual machine has at least one snapshot	None.