Nutanix Monitoring & AIOps
Overview
monitoring is the reactive surface: active and resolved alerts,
alert policies, the event stream, and Prism Central audit logs.
aiops is the analytical surface: capacity planning, VM rightsizing
recommendations, workload trends, and what-if simulations. Together
they answer "what is wrong right now" and "what will run out, and
when" — the two questions behind MSP health checks and quarterly
business reviews.
Key Concepts
| Concept |
Namespace |
Notes |
| Alert |
monitoring |
Severity-ranked (critical/warning/info), tied to a source entity; has resolved/acknowledged state |
| Alert policy |
monitoring |
Rules that generate alerts and notifications |
| Event |
monitoring |
Informational state changes, higher volume than alerts |
| Audit |
monitoring |
Who did what on Prism Central — the compliance trail |
| Rightsizing recommendation |
aiops |
Per-VM sizing verdicts (oversized/undersized/inactive) |
| Capacity analysis |
aiops |
Runway projections per cluster resource (CPU, memory, storage) |
Common Workflows
Alert triage sweep
listOperations(namespace="monitoring", search="alerts") → the
list-alerts operation.monitoring_execute filtered to unresolved alerts, ordered by
severity, _limit=100 and paged.- Group by cluster and severity; lead with criticals. Include each
alert's source entity so findings map to hardware or VMs.
Audit trail pull
- Discover the audit list operation in
monitoring.
- Filter by time window (OData predicate on the timestamp field) and,
when investigating one operator, by user.
- Report chronologically; this is the evidence trail for change
review.
Capacity and rightsizing report
listOperations(namespace="aiops") to see the analysis surface the
connected PC exposes.aiops_execute for capacity/runway data per cluster, then for VM
rightsizing recommendations.- Deliver: per-cluster runway, top oversized VMs (reclaimable
resources), undersized VMs (performance risk), and inactive VMs.
Read-only boundary
Acknowledging or resolving alerts, editing alert policies, and
creating or running AIOps playbooks are non-GET and blocked by
read-only mode. Reports end with recommended actions, not applied
changes.
Gotchas
- Events are high-volume. Always constrain event queries with a
time-window
_filter and _limit; an unbounded event pull is the
easiest way to blow past useful context.
aiops availability varies. Analysis operations depend on PC
version and licensing (Prism Ultimate features); verify with
listOperations before promising a rightsizing report.- Alerts are not events. If a customer asks "what happened",
check both: alerts for actionable conditions, events for the state
changes around them.
opsmgmt is adjacent, not a substitute. It carries shared
platform plumbing for the ops domains; start alert and capacity
questions in monitoring and aiops.
Related Skills
1---2name: nutanix-monitoring-aiops3description: The Nutanix operational-intelligence read surface: `monitoring_execute` for alerts, alert policies, events, and audit logs, and `aiops_execute` for capacity planning, VM rightsizing recommendations, and workload performance analysis — the namespaces behind health checks and capacity reports.4---56# Nutanix Monitoring & AIOps78## Overview910`monitoring` is the reactive surface: active and resolved alerts,11alert policies, the event stream, and Prism Central audit logs.12`aiops` is the analytical surface: capacity planning, VM rightsizing13recommendations, workload trends, and what-if simulations. Together14they answer "what is wrong right now" and "what will run out, and15when" — the two questions behind MSP health checks and quarterly16business reviews.1718## Key Concepts1920| Concept | Namespace | Notes |21|---------|-----------|-------|22| Alert | `monitoring` | Severity-ranked (critical/warning/info), tied to a source entity; has resolved/acknowledged state |23| Alert policy | `monitoring` | Rules that generate alerts and notifications |24| Event | `monitoring` | Informational state changes, higher volume than alerts |25| Audit | `monitoring` | Who did what on Prism Central — the compliance trail |26| Rightsizing recommendation | `aiops` | Per-VM sizing verdicts (oversized/undersized/inactive) |27| Capacity analysis | `aiops` | Runway projections per cluster resource (CPU, memory, storage) |2829## Common Workflows3031### Alert triage sweep32331. `listOperations(namespace="monitoring", search="alerts")` → the34 list-alerts operation.352. `monitoring_execute` filtered to unresolved alerts, ordered by36 severity, `_limit=100` and paged.373. Group by cluster and severity; lead with criticals. Include each38 alert's source entity so findings map to hardware or VMs.3940### Audit trail pull41421. Discover the audit list operation in `monitoring`.432. Filter by time window (OData predicate on the timestamp field) and,44 when investigating one operator, by user.453. Report chronologically; this is the evidence trail for change46 review.4748### Capacity and rightsizing report49501. `listOperations(namespace="aiops")` to see the analysis surface the51 connected PC exposes.522. `aiops_execute` for capacity/runway data per cluster, then for VM53 rightsizing recommendations.543. Deliver: per-cluster runway, top oversized VMs (reclaimable55 resources), undersized VMs (performance risk), and inactive VMs.5657## Read-only boundary5859Acknowledging or resolving alerts, editing alert policies, and60creating or running AIOps playbooks are non-GET and blocked by61read-only mode. Reports end with recommended actions, not applied62changes.6364## Gotchas6566- **Events are high-volume.** Always constrain event queries with a67 time-window `_filter` and `_limit`; an unbounded event pull is the68 easiest way to blow past useful context.69- **`aiops` availability varies.** Analysis operations depend on PC70 version and licensing (Prism Ultimate features); verify with71 `listOperations` before promising a rightsizing report.72- **Alerts are not events.** If a customer asks "what happened",73 check both: alerts for actionable conditions, events for the state74 changes around them.75- **`opsmgmt` is adjacent, not a substitute.** It carries shared76 platform plumbing for the ops domains; start alert and capacity77 questions in `monitoring` and `aiops`.7879## Related Skills8081- [api-patterns](../api-patterns/SKILL.md) — discovery workflow, OData, read-only mode82- [cluster-operations](../cluster-operations/SKILL.md) — cluster health context for alerts83- [vm-management](../vm-management/SKILL.md) — the VMs rightsizing verdicts point at
WYRE-AI