Display VMware Alarm Context in VMAN Alert Notifications Using Custom SWQL Variables

8/27/2026 12:13 PM

8/27/2026 12:13 PM

When a VMAN alert is triggered by a VMware alarm from vCenter, the alert notification may not include the related virtual infrastructure names by default. You can use custom SWQL variables in the alert action to display the vCenter, ESXi host, cluster, datastore, datacenter, and virtual machine associated with the triggered alarm.

The values are retrieved from Orion.VIM.TriggeredAlarmState and the related VMAN entities.

Virtualization Manager

1. Validate the alarm relationships in SWQL Studio

Run the following query to check which relationship IDs are populated for recent triggered alarms:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT
    tas.DisplayName AS AlarmName,
    tas.Timestamp,
    vc.Name AS VCenterName,
    vm.Name AS VMName,
    h.HostName AS ESXiHost,
    cl.Name AS ClusterName,
    dc.Name AS DataCenter,
    ds.Name AS DatastoreName
FROM Orion.VIM.TriggeredAlarmState tas
LEFT JOIN Orion.VIM.VCenters vc 
    ON vc.VCenterID = tas.RelatedVCenter
LEFT JOIN Orion.VIM.VirtualMachines vm 
    ON vm.VirtualMachineID = tas.RelatedVirtualMachine
LEFT JOIN Orion.VIM.Hosts h 
    ON h.HostID = vm.HostID
LEFT JOIN Orion.VIM.Clusters cl 
    ON cl.ClusterID = h.ClusterID
LEFT JOIN Orion.VIM.DataCenters dc 
    ON dc.DataCenterID = h.DataCenterID
LEFT JOIN Orion.VIM.DataStores ds 
    ON ds.DataStoreID = tas.RelatedDatastore

2. Alert Definition 

In your alert definition under triggered action section use the below alert variables (either in Alert Message or Email Body) 

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

 
VM: ${N=SWQL;M=SELECT TOP 1 ISNULL(vm.Name,'') AS VMName FROM Orion.AlertObjects ao JOIN Orion.VIM.TriggeredAlarmState tas ON tas.Uri=ao.EntityUri LEFT JOIN Orion.VIM.VirtualMachines vm ON vm.VirtualMachineID=tas.RelatedVirtualMachine WHERE ao.AlertObjectID=${N=Alerting;M=AlertObjectID}}
 
ESXi Host: ${N=SWQL;M=SELECT TOP 1 ISNULL(h.HostName,'') AS ESXiHost FROM Orion.AlertObjects ao JOIN Orion.VIM.TriggeredAlarmState tas ON tas.Uri=ao.EntityUri LEFT JOIN Orion.VIM.VirtualMachines vm ON vm.VirtualMachineID=tas.RelatedVirtualMachine LEFT JOIN Orion.VIM.Hosts h ON h.HostID=vm.HostID WHERE ao.AlertObjectID=${N=Alerting;M=AlertObjectID}}
 
Cluster: ${N=SWQL;M=SELECT TOP 1 ISNULL(cl.Name,'') AS ClusterName FROM Orion.AlertObjects ao JOIN Orion.VIM.TriggeredAlarmState tas ON tas.Uri=ao.EntityUri LEFT JOIN Orion.VIM.VirtualMachines vm ON vm.VirtualMachineID=tas.RelatedVirtualMachine LEFT JOIN Orion.VIM.Hosts h ON h.HostID=vm.HostID LEFT JOIN Orion.VIM.Clusters cl ON cl.ClusterID=h.ClusterID WHERE ao.AlertObjectID=${N=Alerting;M=AlertObjectID}}
 
Datacenter: ${N=SWQL;M=SELECT TOP 1 ISNULL(dc.Name,'') AS DataCenterName FROM Orion.AlertObjects ao JOIN Orion.VIM.TriggeredAlarmState tas ON tas.Uri=ao.EntityUri LEFT JOIN Orion.VIM.VirtualMachines vm ON vm.VirtualMachineID=tas.RelatedVirtualMachine LEFT JOIN Orion.VIM.Hosts h ON h.HostID=vm.HostID LEFT JOIN Orion.VIM.DataCenters dc ON dc.DataCenterID=h.DataCenterID WHERE ao.AlertObjectID=${N=Alerting;M=AlertObjectID}}
 
vCenter: ${N=SWQL;M=SELECT TOP 1 ISNULL(vc.Name,'') AS VCenterName FROM Orion.AlertObjects ao JOIN Orion.VIM.TriggeredAlarmState tas ON tas.Uri=ao.EntityUri LEFT JOIN Orion.VIM.VCenters vc ON vc.VCenterID=tas.RelatedVCenter WHERE ao.AlertObjectID=${N=Alerting;M=AlertObjectID}}
 
Datastore: ${N=SWQL;M=SELECT TOP 1 ISNULL(ds.Name,'') AS DatastoreName FROM Orion.AlertObjects ao JOIN Orion.VIM.TriggeredAlarmState tas ON tas.Uri=ao.EntityUri LEFT JOIN Orion.VIM.DataStores ds ON ds.DataStoreID=tas.RelatedDatastore WHERE ao.AlertObjectID=${N=Alerting;M=AlertObjectID}}

3. Sample Alert Generated  :