VMware ESXi and vSphere Cluster Management
vSphere Alarm Trigger Types: Condition and Event Triggers
Learn how vSphere condition/state and event alarm triggers differ, when to use each, and how to design reliable alerts for hosts, VMs, datastores, and vCenter objects.
A vSphere alarm is a monitoring rule that evaluates configured criteria and raises an alert when those criteria are met. An alarm needs one or more alarm triggers to define what should cause it to activate.
The trigger identifies the monitored condition or recorded occurrence. The resulting alarm notification or action is separate: the trigger detects a situation, while the alarm response can notify an administrator or perform a configured action.
The key design question is whether you need to detect an ongoing current state or a discrete event that happened. Condition/state triggers handle the first case; event triggers handle the second.
For broader alarm concepts, see Alarms in vSphere.
Condition or State Triggers
A condition trigger, also called a state trigger, evaluates the present condition, state, or measured value of a monitored inventory object. These triggers are useful when the condition remains important for as long as it exists.
Condition/state triggers commonly apply to:
- ESXi hosts, which run virtual machines.
- Virtual machines, including their power state and snapshot-related values.
- Datastores, including availability and connection state.
States and Performance Metrics
A trigger can compare an object's current state with an expected state. Examples include a virtual machine being powered off when it should be powered on, or a datastore having a disconnected connection state.
It can also evaluate a performance metric, which is a measurable resource or operational value. Examples include host memory utilization and virtual machine snapshot size. A threshold is the configured boundary that determines when the value becomes alert-worthy.
For example, an alarm can use a condition trigger to raise an alert when ESXi host memory utilization reaches 90 percent. The alarm remains relevant while the configured condition persists or the metric continues to breach the threshold. This differs from an event, which records that something occurred at a particular point in time.
Condition Trigger Examples
- Large VM snapshot: Monitor a virtual machine and alarm when snapshot size exceeds an administrator-defined limit.
- High host memory usage: Monitor an ESXi host and alarm when memory utilization reaches 90 percent.
- Disconnected datastore: Monitor a datastore and alarm when its connection state is disconnected.
Event Triggers
An event trigger responds to a recorded event generated by an operation or change involving a vCenter Server object. An event represents something that happened; it is not a continuously measured current state.
Event triggers match a particular event and can refine the match with event-specific arguments, operators, and configured values:
- An argument is an event attribute used to narrow which event instances match.
- An operator is the comparison method used with an argument and value, such as an equality or other supported comparison.
- The configured value supplies the data against which the argument is compared.
For example, an event trigger can match an ESXi host hardware-health change. It can also match a license-expiration event for a vCenter-related object, using applicable event arguments and comparisons to select the relevant event instances.
Event Trigger Examples
- Host hardware health change: Match a recorded hardware-health change event for an ESXi host, optionally narrowing the match with relevant attributes.
- License expiration: Match a license-expiration event using the event's applicable arguments, operators, and values.
Condition/State Triggers vs. Event Triggers
| Characteristic | Condition/State Trigger | Event Trigger |
|---|---|---|
| What is monitored | The current condition, state, or measured value of an object. | A recorded operation, change, or occurrence involving a vCenter Server object. |
| Evaluation model | Evaluates a present state or compares a metric with a threshold. | Matches an event and its configured arguments, operators, and values. |
| Typical criteria | Power state, connection state, utilization, or snapshot size. | Hardware-health change, license expiration, or another selected event. |
| Applicable examples | High ESXi host memory use, a disconnected datastore, or an oversized VM snapshot. | An ESXi host hardware-health change or a license-expiration event. |
| Best use cases | Ongoing health, capacity, availability, power, and connection monitoring. | Reporting an operational occurrence or state transition that was recorded. |
Choosing the Right Trigger Type
Use a condition/state trigger when the question is, “Is this object currently in an unacceptable state?” This is appropriate for ongoing health and capacity concerns, such as sustained high memory utilization, a disconnected datastore, or a snapshot that has grown beyond an operational limit.
Use an event trigger when the question is, “Did this operation or change occur?” This is appropriate when the occurrence itself must be reported, such as a hardware-health change or a license-expiration event.
The same operational area may require either trigger type. For example, storage monitoring can use a condition trigger to detect that a datastore is currently disconnected. A separate event trigger might report a recorded storage-related change. The correct choice depends on whether the desired alert concerns the current result or the action and transition that produced it.
| Monitoring Goal | Target Object | Recommended Trigger Type | Trigger Criterion |
|---|---|---|---|
| Oversized VM snapshot | Virtual machine | Condition/state | Snapshot size exceeds the configured limit. |
| High host memory use | ESXi host | Condition/state | Memory utilization reaches the configured threshold, such as 90 percent. |
| Datastore disconnection | Datastore | Condition/state | Connection state is disconnected. |
| Hardware health change | ESXi host | Event | A matching hardware-health change event is recorded. |
| License expiration | vCenter-related object | Event | A license-expiration event matches the selected arguments, operators, and values. |
Alarm Criteria Design Workflow
- Identify the target: Select the ESXi host, virtual machine, datastore, or other vSphere inventory object to monitor.
- Create or edit the alarm: Apply the alarm at the intended object scope.
- Select the trigger model: Choose a condition/state trigger for an ongoing condition or an event trigger for a recorded occurrence.
- Configure a condition: Select the state or performance metric, then set the expected state or an appropriate threshold. Confirm units and the meaning of the boundary.
- Configure an event: Select the relevant event and refine matching with available arguments, operators, and values.
- Review the risk represented: Confirm that the criteria identify a meaningful operational problem without matching normal activity.
Practical Configuration Examples
Example 1: Monitor a Large Virtual Machine Snapshot
Select the virtual machine as the target and choose a condition/state trigger. Select snapshot size as the measured value and configure the administrator-defined size limit. This detects an ongoing measurable condition: the snapshot remains above the limit until it is reduced or removed.
Example 2: Monitor ESXi Host Memory
Select the ESXi host and choose a condition/state trigger for the memory-utilization performance metric. Configure a threshold of 90 percent if that matches the environment's operational policy. Check that the threshold and unit assumptions reflect the desired capacity risk.
Example 3: Monitor Datastore Availability
Select the datastore and choose a condition/state trigger for connection state. Set the desired state to connected, or configure the disconnected state as the alarm condition according to the available alarm criteria. This monitors current availability rather than a single historical event.
Example 4: Report a Hardware-Health Change
Select the ESXi host and choose an event trigger. Select the hardware-health change event and use relevant event attributes to avoid matching unrelated health records. This reports a recorded operational change.
Example 5: Report License Expiration
Select the applicable vCenter-related object and choose an event trigger for license expiration. Review the event's available arguments, select suitable operators, and provide values that identify the license or scope of interest.
Troubleshooting Trigger Problems
An Alarm Does Not Activate for High Resource Utilization
Likely causes include selecting an event trigger instead of a condition/state trigger, choosing the wrong performance metric, setting an unsuitable threshold, or attaching the alarm to the wrong object or scope.
- Confirm that the trigger monitors the intended performance metric.
- Verify the threshold value, units, and comparison behavior.
- Confirm that the selected target is the intended ESXi host, virtual machine, or datastore.
An Expected Operational Event Does Not Generate an Alarm
Likely causes include using a condition trigger for a discrete event, selecting an event type that does not match the recorded event, or filtering out the event with arguments, operators, or values.
- Verify that an event trigger is configured.
- Review the recorded event type and its available arguments.
- Validate every argument comparison and configured value.
The Environment Generates Too Many Alerts
Excessive alerts can result from thresholds that are too sensitive, event criteria that are too broad, or an alarm applied to more objects than necessary.
- Adjust condition thresholds to align with normal operational baselines.
- Narrow event matching with relevant arguments and values.
- Review the alarm's target scope and apply it only where the risk exists.
Exam-Relevant Notes
- A condition/state trigger evaluates an object's current state or a measurable value.
- An event trigger matches a recorded vCenter-related event.
- Thresholds are associated with measurable condition monitoring, such as utilization or snapshot size.
- Event arguments, operators, and values refine which event instances match.
- Choose the trigger based on whether the requirement concerns an ongoing condition or a discrete occurrence.
After selecting the trigger type, configure the alarm response separately. See vSphere alarm actions explained and acknowledging an alarm for related alarm-management concepts.