@oneuptime/common 13.0.0 → 13.0.3

package/Server/Utils/IncomingCallPhoneNumber.ts

@@ -6,36 +6,49 @@ import Route from "../../Types/API/Route";
 import URL from "../../Types/API/URL";
 import API from "../../Utils/API";
 import ObjectID from "../../Types/ObjectID";
+import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../Types/API/HTTPResponse";
+import { JSONObject } from "../../Types/JSON";
+import APIException from "../../Types/Exception/ApiException";
 
 /*
  * Releases a provisioned incoming-call number on the call provider by delegating
  * to the notification app's internal endpoint (the Common layer cannot reach the
- * provider directly). Best-effort: failures are logged but never thrown, so a
- * provider/network issue during cleanup does not block the parent delete.
+ * provider directly). A failed release must block the parent delete; otherwise
+ * the only config/SID metadata needed to retry is lost while the customer can
+ * continue to be billed for the orphaned provider number.
  */
 export default async function releaseIncomingCallPhoneNumber(data: {
   projectCallSMSConfigId: ObjectID;
   callProviderPhoneNumberId: string;
 }): Promise<void> {
   try {
-    await API.post({
-      url: new URL(
-        Protocol.HTTP,
-        AppApiHostname,
-        new Route("/api/notification/phone-number/internal/release"),
-      ),
-      data: {
-        projectCallSMSConfigId: data.projectCallSMSConfigId.toString(),
-        callProviderPhoneNumberId: data.callProviderPhoneNumberId,
-      },
-      headers: {
-        ...ClusterKeyAuthorization.getClusterKeyHeaders(),
-      },
-    });
+    const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+      await API.post<JSONObject>({
+        url: new URL(
+          Protocol.HTTP,
+          AppApiHostname,
+          new Route("/api/notification/phone-number/internal/release"),
+        ),
+        data: {
+          projectCallSMSConfigId: data.projectCallSMSConfigId.toString(),
+          callProviderPhoneNumberId: data.callProviderPhoneNumberId,
+        },
+        headers: {
+          ...ClusterKeyAuthorization.getClusterKeyHeaders(),
+        },
+      });
+
+    if (response.isFailure()) {
+      throw new APIException(
+        `Notification service could not release the incoming-call phone number (HTTP ${response.statusCode}).`,
+      );
+    }
   } catch (err) {
     logger.error(
       "Failed to release incoming-call phone number on the provider during cleanup:",
     );
     logger.error(err);
+    throw err;
   }
 }

package/Server/Utils/LogRedaction.ts

@@ -75,6 +75,7 @@ const SENSITIVE_KEY_FRAGMENTS: Array<string> = [
   "onetimecode",
   "logincode",
   "resetcode",
+  "codeverifier",
   /*
    * A DSN carries the password inline, so the key name is the only signal
    * we get before the value is already in the log line.
@@ -232,7 +233,7 @@ export const isSensitiveLogKey: IsSensitiveLogKeyFunction = (
  * are too short to match safely against free-form prose.
  */
 const TEXT_SECRET_WORDS: string =
-  "password|passwd|passphrase|secret|token|credential|credentials|authorization|cookie|api[_-]?key|private[_-]?key|access[_-]?key|assertion|attestation|signature|raw[_-]?id|client[_-]?data[_-]?json|authenticator[_-]?data|user[_-]?handle|two[_-]?factor[_-]?secret";
+  "password|passwd|passphrase|secret|token|credential|credentials|authorization|cookie|api[_-]?key|private[_-]?key|access[_-]?key|assertion|attestation|signature|raw[_-]?id|client[_-]?data[_-]?json|authenticator[_-]?data|user[_-]?handle|two[_-]?factor[_-]?secret|code[_-]?verifier";
 
 // Bounded, so a long non-matching run cannot blow up on backtracking.
 const KEY_PREFIX: string = "[A-Za-z0-9_.-]{0,40}";

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -673,7 +673,7 @@ export default class MonitorAlert {
             /*
              * Attach every resource this series identifies — host, docker
              * host, podman host, k8s cluster, service, and the Proxmox /
-             * Ceph / Swarm / IoT clusters — resolved from the shared label
+             * VMware vCenter / Ceph / Swarm / IoT clusters — resolved from the shared label
              * key map. Same call the incident path makes, so the two can't
              * drift apart again.
              */

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -83,6 +83,8 @@ import MetricMonitorResponse, {
   KubernetesResourceBreakdown,
   ProxmoxAffectedResource,
   ProxmoxResourceBreakdown,
+  VMwareAffectedResource,
+  VMwareResourceBreakdown,
   CephAffectedResource,
   CephResourceBreakdown,
   DockerSwarmAffectedResource,
@@ -98,11 +100,13 @@ import MonitorStepDockerMonitor from "../../../Types/Monitor/MonitorStepDockerMo
 import MonitorStepHostMonitor from "../../../Types/Monitor/MonitorStepHostMonitor";
 import MonitorStepPodmanMonitor from "../../../Types/Monitor/MonitorStepPodmanMonitor";
 import MonitorStepProxmoxMonitor from "../../../Types/Monitor/MonitorStepProxmoxMonitor";
+import MonitorStepVMwareMonitor from "../../../Types/Monitor/MonitorStepVMwareMonitor";
 import MonitorStepCephMonitor from "../../../Types/Monitor/MonitorStepCephMonitor";
 import MonitorStepDockerSwarmMonitor from "../../../Types/Monitor/MonitorStepDockerSwarmMonitor";
 import MetricValueFormatter from "../../../Utils/Monitor/MetricValueFormatter";
 import { getKubernetesMetricByMetricName } from "../../../Types/Monitor/KubernetesMetricCatalog";
 import { getProxmoxMetricByMetricName } from "../../../Types/Monitor/ProxmoxMetricCatalog";
+import { getVMwareMetricByMetricName } from "../../../Types/Monitor/VMwareMetricCatalog";
 import { getCephMetricByMetricName } from "../../../Types/Monitor/CephMetricCatalog";
 import { getDockerSwarmMetricByMetricName } from "../../../Types/Monitor/DockerSwarmMetricCatalog";
 
@@ -482,7 +486,7 @@ ${contextBlock}
   }
 
   /**
-   * For metric-backed monitors (Metrics/Kubernetes/Docker/Proxmox/Ceph)
+   * For metric-backed monitors (Metrics/Kubernetes/Docker/Proxmox/VMware/Ceph)
    * with per-series aggregated results, re-evaluate the matched criteria
    * once per series and return one entry per series that breached.
    * Returns an empty array when the monitor is not series-aware or
@@ -1103,6 +1107,7 @@ ${contextBlock}
       input.monitor.monitorType === MonitorType.Podman ||
       input.monitor.monitorType === MonitorType.DockerSwarm ||
       input.monitor.monitorType === MonitorType.Proxmox ||
+      input.monitor.monitorType === MonitorType.VMware ||
       input.monitor.monitorType === MonitorType.Ceph ||
       input.monitor.monitorType === MonitorType.IoTDevice
     ) {
@@ -1282,6 +1287,11 @@ ${contextBlock}
       return MonitorCriteriaEvaluator.buildProxmoxRootCauseContext(input);
     }
 
+    // Handle VMware monitors with vCenter resource context
+    if (input.monitor.monitorType === MonitorType.VMware) {
+      return MonitorCriteriaEvaluator.buildVMwareRootCauseContext(input);
+    }
+
     // Handle Docker Swarm monitors with resource context
     if (input.monitor.monitorType === MonitorType.DockerSwarm) {
       return MonitorCriteriaEvaluator.buildDockerSwarmRootCauseContext(input);
@@ -1361,6 +1371,15 @@ ${contextBlock}
       );
     }
 
+    /*
+     * How many times the probe actually tried matters when reading a failure:
+     * "tried once" and "tried three times" describe very different levels of
+     * confidence, and the count was already collected but never shown.
+     */
+    if (probeResponse?.totalAttempts !== undefined) {
+      responseDetails.push(`- Attempts: ${probeResponse.totalAttempts}`);
+    }
+
     // Add Request Failed Details if available
     if (probeResponse?.requestFailedDetails) {
       const requestFailedDetails: RequestFailedDetails =
@@ -2013,7 +2032,7 @@ ${contextBlock}
    * shown here can never disagree with the metric name shown beside it.
    */
   private static getPlatformMetricUnit(input: {
-    platform: "kubernetes" | "proxmox" | "dockerSwarm" | "ceph";
+    platform: "kubernetes" | "proxmox" | "vmware" | "dockerSwarm" | "ceph";
     metricName: string;
   }): string | undefined {
     switch (input.platform) {
@@ -2021,6 +2040,14 @@ ${contextBlock}
         return getKubernetesMetricByMetricName(input.metricName)?.unit;
       case "proxmox":
         return getProxmoxMetricByMetricName(input.metricName)?.unit;
+      case "vmware":
+        /*
+         * The vcenter receiver's utilization metrics are already 0–100
+         * percentages (unit "%"), never [0, 1] ratios — the catalog
+         * says "%" and the formatter renders it as-is, so 92.5 reads
+         * "92.50%" and never "9250.00%".
+         */
+        return getVMwareMetricByMetricName(input.metricName)?.unit;
       case "dockerSwarm":
         return getDockerSwarmMetricByMetricName(input.metricName)?.unit;
       case "ceph":
@@ -2037,7 +2064,7 @@ ${contextBlock}
    * it is the one number in the row a reader scans for.
    */
   private static formatPlatformResourceValue(input: {
-    platform: "kubernetes" | "proxmox" | "dockerSwarm" | "ceph";
+    platform: "kubernetes" | "proxmox" | "vmware" | "dockerSwarm" | "ceph";
     metricName: string;
     value: number;
   }): string {
@@ -2651,6 +2678,278 @@ ${contextBlock}
     return sections.length > 0 ? sections.join("\n") : null;
   }
 
+  /*
+   * Which vSphere object one VMware breakdown row describes, resolved
+   * from the identity attributes the vcenter receiver stamped on it —
+   * most specific first, in the same order the ingest inventory scan
+   * uses, so the Kind column here and the inventory's `kind` never
+   * disagree about the same series. A VM row carries its parent host
+   * (and often a resource pool), so the VM check must run before the
+   * host and pool checks.
+   */
+  private static getVMwareAffectedResourceKind(
+    resource: VMwareAffectedResource,
+  ): string | undefined {
+    if (resource.vmName || resource.vmId) {
+      return "Virtual Machine";
+    }
+
+    if (resource.resourcePoolPath || resource.resourcePoolName) {
+      return "Resource Pool";
+    }
+
+    if (resource.hostName) {
+      return "Host";
+    }
+
+    if (resource.datastoreName) {
+      return "Datastore";
+    }
+
+    if (resource.clusterName) {
+      return "Cluster";
+    }
+
+    if (resource.datacenterName) {
+      return "Datacenter";
+    }
+
+    return undefined;
+  }
+
+  private static buildVMwareRootCauseContext(input: {
+    dataToProcess: DataToProcess;
+    monitorStep: MonitorStep;
+    monitor: Monitor;
+  }): string | null {
+    const metricResponse: MetricMonitorResponse =
+      input.dataToProcess as MetricMonitorResponse;
+
+    const breakdown: VMwareResourceBreakdown | undefined =
+      metricResponse.vmwareResourceBreakdown;
+
+    const sections: Array<string> = [];
+
+    // vCenter context
+    const vmwareMonitor: MonitorStepVMwareMonitor | undefined =
+      input.monitorStep.data?.vmwareMonitor;
+
+    if (vmwareMonitor || breakdown) {
+      const vcenterDetails: Array<string> = [];
+      vcenterDetails.push(
+        `- vCenter: ${breakdown?.vcenterName || vmwareMonitor?.vcenterIdentifier || "Unknown"}`,
+      );
+
+      if (breakdown) {
+        vcenterDetails.push(
+          `- Metric: ${breakdown.metricFriendlyName} (\`${breakdown.metricName}\`)`,
+        );
+      } else if (
+        vmwareMonitor &&
+        vmwareMonitor.metricViewConfig?.queryConfigs?.length > 0 &&
+        vmwareMonitor.metricViewConfig.queryConfigs[0]
+      ) {
+        const metricName: string = vmwareMonitor.metricViewConfig
+          .queryConfigs[0].metricQueryData?.filterData?.metricName as string;
+        if (metricName) {
+          vcenterDetails.push(`- Metric: \`${metricName}\``);
+        }
+      }
+
+      /*
+       * The worker maps each resource filter to an equality on the
+       * matching `resource.vcenter.*` attribute; surface the same
+       * filters so the incident shows WHAT was scoped.
+       */
+      if (vmwareMonitor?.resourceFilters?.datacenterName) {
+        vcenterDetails.push(
+          `- Datacenter Filter: ${vmwareMonitor.resourceFilters.datacenterName}`,
+        );
+      }
+
+      if (vmwareMonitor?.resourceFilters?.clusterName) {
+        vcenterDetails.push(
+          `- Cluster Filter: ${vmwareMonitor.resourceFilters.clusterName}`,
+        );
+      }
+
+      if (vmwareMonitor?.resourceFilters?.hostName) {
+        vcenterDetails.push(
+          `- Host Filter: ${vmwareMonitor.resourceFilters.hostName}`,
+        );
+      }
+
+      if (vmwareMonitor?.resourceFilters?.vmName) {
+        vcenterDetails.push(
+          `- Virtual Machine Filter: ${vmwareMonitor.resourceFilters.vmName}`,
+        );
+      }
+
+      if (vmwareMonitor?.resourceFilters?.datastoreName) {
+        vcenterDetails.push(
+          `- Datastore Filter: ${vmwareMonitor.resourceFilters.datastoreName}`,
+        );
+      }
+
+      if (vmwareMonitor?.resourceFilters?.resourcePoolPath) {
+        vcenterDetails.push(
+          `- Resource Pool Filter: ${vmwareMonitor.resourceFilters.resourcePoolPath}`,
+        );
+      }
+
+      sections.push(`**vCenter Details**\n${vcenterDetails.join("\n")}`);
+    }
+
+    // Affected resources (Resource / Kind / Host / Cluster / Value)
+    let renderedBreakdownTable: boolean = false;
+
+    if (breakdown && breakdown.affectedResources.length > 0) {
+      /*
+       * K8s/Proxmox-parity render: drop zero-value rows, worst (highest)
+       * first, top 10. For count metrics filtered to an unhealthy state
+       * (`vcenter.datacenter.host.count{status=red}`) the non-zero rows
+       * ARE the objects with a problem, so the table reads correctly;
+       * a zero row means "nothing in that state" and adds nothing. The
+       * per-series criteria evaluation is what actually alerts; this
+       * table is supplementary context only.
+       */
+      const sortedResources: Array<VMwareAffectedResource> = [
+        ...breakdown.affectedResources,
+      ]
+        .filter((r: VMwareAffectedResource) => {
+          return r.metricValue > 0;
+        })
+        .sort((a: VMwareAffectedResource, b: VMwareAffectedResource) => {
+          return b.metricValue - a.metricValue;
+        });
+
+      /*
+       * Skip the table when no row carries any identity attribute — it
+       * would add nothing. Every vcenter-receiver series carries at
+       * least `vcenter.datacenter.name`, so this only trips on a
+       * breakdown the worker could not attribute at all.
+       */
+      const hasIdentity: boolean = sortedResources.some(
+        (r: VMwareAffectedResource) => {
+          return Boolean(
+            MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(r),
+          );
+        },
+      );
+
+      if (sortedResources.length > 0 && hasIdentity) {
+        const resourcesToShow: Array<VMwareAffectedResource> =
+          sortedResources.slice(0, 10);
+
+        const resourceLines: Array<string> = [];
+        resourceLines.push(`| Resource | Kind | Host | Cluster | Value |`);
+        resourceLines.push(`| --- | --- | --- | --- | --- |`);
+
+        for (const resource of resourcesToShow) {
+          const kind: string | undefined =
+            MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(resource);
+
+          let resourceCell: string = "-";
+          let hostCell: string = "-";
+
+          switch (kind) {
+            case "Virtual Machine":
+              /*
+               * The VM's display name, falling back to its instance
+               * UUID (`vcenter.vm.id`) when the receiver stamped no
+               * name. The Host column carries the ESXi host the VM is
+               * running on.
+               */
+              resourceCell = resource.vmName
+                ? `\`${resource.vmName}\``
+                : `\`${resource.vmId}\``;
+              hostCell = resource.hostName ? `\`${resource.hostName}\`` : "-";
+              break;
+            case "Resource Pool":
+              /*
+               * Pool names are only unique within a parent, so the
+               * inventory path is shown next to the name. The Host
+               * column is the owner host for a pool on a standalone
+               * ESXi host (pools under a cluster show the cluster).
+               */
+              if (resource.resourcePoolName && resource.resourcePoolPath) {
+                resourceCell = `\`${resource.resourcePoolName}\` (\`${resource.resourcePoolPath}\`)`;
+              } else {
+                resourceCell = `\`${resource.resourcePoolPath || resource.resourcePoolName}\``;
+              }
+              hostCell = resource.hostName ? `\`${resource.hostName}\`` : "-";
+              break;
+            case "Host":
+              // The host IS the resource; repeating it in the Host column adds nothing.
+              resourceCell = `\`${resource.hostName}\``;
+              break;
+            case "Datastore":
+              resourceCell = `\`${resource.datastoreName}\``;
+              break;
+            case "Cluster":
+              resourceCell = `\`${resource.clusterName}\``;
+              break;
+            case "Datacenter":
+              resourceCell = `\`${resource.datacenterName}\``;
+              break;
+            default:
+              break;
+          }
+
+          const kindCell: string = kind || "-";
+          const clusterCell: string =
+            kind !== "Cluster" && resource.clusterName
+              ? `\`${resource.clusterName}\``
+              : "-";
+
+          resourceLines.push(
+            `| ${resourceCell} | ${kindCell} | ${hostCell} | ${clusterCell} | ${MonitorCriteriaEvaluator.formatPlatformResourceValue(
+              {
+                platform: "vmware",
+                metricName: breakdown.metricName,
+                value: resource.metricValue,
+              },
+            )} |`,
+          );
+        }
+
+        if (sortedResources.length > 10) {
+          resourceLines.push(
+            `\n*... and ${sortedResources.length - 10} more affected resources*`,
+          );
+        }
+
+        sections.push(
+          `\n\n**Affected Resources** (${sortedResources.length} total)\n\n${resourceLines.join("\n")}`,
+        );
+        renderedBreakdownTable = true;
+      }
+    }
+
+    // Metric results summary (fallback context when no table rendered)
+    if (
+      !renderedBreakdownTable &&
+      metricResponse.metricResult &&
+      metricResponse.metricResult.length > 0
+    ) {
+      const resultDetails: Array<string> = [];
+
+      for (const result of metricResponse.metricResult) {
+        if (result.data && result.data.length > 0) {
+          resultDetails.push(
+            `- ${result.data.length} metric data point(s) returned`,
+          );
+        }
+      }
+
+      if (resultDetails.length > 0) {
+        sections.push(`\n\n**Metric Summary**\n${resultDetails.join("\n")}`);
+      }
+    }
+
+    return sections.length > 0 ? sections.join("\n") : null;
+  }
+
   private static buildDockerSwarmRootCauseContext(input: {
     dataToProcess: DataToProcess;
     monitorStep: MonitorStep;

package/Server/Utils/Monitor/MonitorMaintenanceSuppression.ts

@@ -30,6 +30,13 @@ export interface MaintainedResourceKeys {
    * the name set is ever matched; the id set exists for shape parity.
    */
   proxmoxClusters: ResourceKeySet;
+  /*
+   * vCenters, like Proxmox/Ceph clusters, have no `oneuptime.*.id`
+   * label stamp (the VMware Agent stamps `vmware.vcenter.name` only),
+   * so only the name set is ever matched; the id set exists for shape
+   * parity.
+   */
+  vmwareVCenters: ResourceKeySet;
   cephClusters: ResourceKeySet;
   /*
    * Docker Swarm clusters, like Proxmox/Ceph clusters, have no
@@ -64,8 +71,8 @@ export interface MaintainedResourceKeys {
  * incident/alert creation loops can skip exactly those series while the
  * other 90 hosts keep alerting. It covers every resource type a
  * maintenance event can attach to AND a series can identify: Host,
- * DockerHost, KubernetesCluster, ProxmoxCluster, CephCluster, and
- * Service.
+ * DockerHost, KubernetesCluster, ProxmoxCluster, VMwareVCenter,
+ * CephCluster, and Service.
  */
 export default class MonitorMaintenanceSuppression {
   /*
@@ -142,6 +149,10 @@ export default class MonitorMaintenanceSuppression {
           refs.proxmoxClusterNames,
           input.maintained.proxmoxClusters.names,
         ) ||
+        this.intersects(
+          refs.vmwareVCenterNames,
+          input.maintained.vmwareVCenters.names,
+        ) ||
         this.intersects(
           refs.cephClusterNames,
           input.maintained.cephClusters.names,
@@ -185,6 +196,8 @@ export default class MonitorMaintenanceSuppression {
       maintained.kubernetesClusters.names.size > 0 ||
       maintained.proxmoxClusters.ids.size > 0 ||
       maintained.proxmoxClusters.names.size > 0 ||
+      maintained.vmwareVCenters.ids.size > 0 ||
+      maintained.vmwareVCenters.names.size > 0 ||
       maintained.cephClusters.ids.size > 0 ||
       maintained.cephClusters.names.size > 0 ||
       maintained.dockerSwarmClusters.ids.size > 0 ||
@@ -198,8 +211,8 @@ export default class MonitorMaintenanceSuppression {
 
   /*
    * Collect the ids + identifiers of every Host / DockerHost /
-   * PodmanHost / KubernetesCluster / ProxmoxCluster / CephCluster /
-   * DockerSwarmCluster / IoTFleet / Service attached to an ongoing
+   * PodmanHost / KubernetesCluster / ProxmoxCluster / VMwareVCenter /
+   * CephCluster / DockerSwarmCluster / IoTFleet / Service attached to an ongoing
    * maintenance event in this project. Monitors attached
    * to the event are intentionally not collected here — those are
    * already handled upstream by the whole-monitor disable flag, which
@@ -214,6 +227,7 @@ export default class MonitorMaintenanceSuppression {
       podmanHosts: { ids: new Set<string>(), names: new Set<string>() },
       kubernetesClusters: { ids: new Set<string>(), names: new Set<string>() },
       proxmoxClusters: { ids: new Set<string>(), names: new Set<string>() },
+      vmwareVCenters: { ids: new Set<string>(), names: new Set<string>() },
       cephClusters: { ids: new Set<string>(), names: new Set<string>() },
       dockerSwarmClusters: {
         ids: new Set<string>(),
@@ -238,6 +252,7 @@ export default class MonitorMaintenanceSuppression {
           podmanHosts: { _id: true, hostIdentifier: true },
           kubernetesClusters: { _id: true, clusterIdentifier: true },
           proxmoxClusters: { _id: true, name: true },
+          vmwareVCenters: { _id: true, name: true },
           cephClusters: { _id: true, name: true },
           dockerSwarmClusters: { _id: true, name: true },
           iotFleets: { _id: true, name: true },
@@ -282,6 +297,13 @@ export default class MonitorMaintenanceSuppression {
           proxmoxCluster.name,
         );
       }
+      for (const vmwareVCenter of event.vmwareVCenters || []) {
+        this.addKey(
+          maintained.vmwareVCenters,
+          vmwareVCenter._id,
+          vmwareVCenter.name,
+        );
+      }
       for (const cephCluster of event.cephClusters || []) {
         this.addKey(maintained.cephClusters, cephCluster._id, cephCluster.name);
       }

package/Server/Utils/Monitor/MonitorResourceContext.ts

@@ -25,9 +25,10 @@ import SeriesResourceLinker, {
  *
  * The deterministic source is the monitor's own step config, which
  * always carries whatever the user picked when they built the monitor:
- * a hostIdentifier, a clusterIdentifier, a fleetIdentifier, a set of
- * telemetryServiceIds, or a metric attribute filter. This module reads
- * it once per evaluation and resolves it to real rows.
+ * a hostIdentifier, a clusterIdentifier, a vcenterIdentifier, a
+ * fleetIdentifier, a set of telemetryServiceIds, or a metric attribute
+ * filter. This module reads it once per evaluation and resolves it to
+ * real rows.
  *
  * This supersedes the old MonitorClusterContext, which did the same
  * thing for exactly four cluster types (Proxmox / Ceph / Docker Swarm /
@@ -99,6 +100,7 @@ export default class MonitorResourceContextUtil {
       kubernetesClusterIds: [],
       serviceIds: [],
       proxmoxClusterIds: [],
+      vmwareVCenterIds: [],
       cephClusterIds: [],
       dockerSwarmClusterIds: [],
       iotFleetIds: [],

package/Server/Utils/Monitor/MonitorStepResourceIdentity.ts

@@ -48,6 +48,7 @@ type NameRefKey = keyof Pick<
   | "podmanHostNames"
   | "kubernetesClusterNames"
   | "proxmoxClusterNames"
+  | "vmwareVCenterNames"
   | "cephClusterNames"
   | "dockerSwarmClusterNames"
   | "iotFleetNames"
@@ -183,6 +184,17 @@ export default class MonitorStepResourceIdentity {
           key: "proxmoxClusterNames",
           value: stepData.proxmoxMonitor?.clusterIdentifier,
         };
+      case MonitorType.VMware:
+        /*
+         * The `vmware.vcenter.name` the VMware Agent stamps. Returned
+         * untrimmed and untyped on purpose: the caller's `typeof`
+         * guard is what keeps a numeric or object identifier written by
+         * the API from throwing out of alert/incident creation.
+         */
+        return {
+          key: "vmwareVCenterNames",
+          value: stepData.vmwareMonitor?.vcenterIdentifier,
+        };
       case MonitorType.Ceph:
         return {
           key: "cephClusterNames",
@@ -327,6 +339,7 @@ export default class MonitorStepResourceIdentity {
       stepData.dockerMonitor?.metricViewConfig,
       stepData.podmanMonitor?.metricViewConfig,
       stepData.proxmoxMonitor?.metricViewConfig,
+      stepData.vmwareMonitor?.metricViewConfig,
       stepData.cephMonitor?.metricViewConfig,
       stepData.dockerSwarmMonitor?.metricViewConfig,
       stepData.iotMonitor?.metricViewConfig,
@@ -421,6 +434,7 @@ export default class MonitorStepResourceIdentity {
       kubernetesClusterNames: [],
       dockerSwarmClusterNames: [],
       proxmoxClusterNames: [],
+      vmwareVCenterNames: [],
       cephClusterNames: [],
       iotFleetNames: [],
       serviceIds: [],

package/Server/Utils/Monitor/MonitorTemplateUtil.ts

@@ -517,6 +517,7 @@ export default class MonitorTemplateUtil {
         data.monitorType === MonitorType.Podman ||
         data.monitorType === MonitorType.DockerSwarm ||
         data.monitorType === MonitorType.Proxmox ||
+        data.monitorType === MonitorType.VMware ||
         data.monitorType === MonitorType.Ceph
       ) {
         const metricResponse: MetricMonitorResponse =

package/Server/Utils/Monitor/SeriesResourceLabels.ts

@@ -118,6 +118,26 @@ export const CephClusterNameLabelKeys: ReadonlyArray<string> = [
   "ceph.cluster.name",
 ];
 
+/*
+ * vCenter identity rides the agent-stamped resource attribute
+ * (`vmware.vcenter.name` — one value per vCenter Server or standalone
+ * ESXi host the VMware Agent connects to) and its ClickHouse
+ * `resource.`-prefixed twin. Ingest keys vCenter rows by name only —
+ * there is no `oneuptime.*.id` stamp for vCenters — so only name keys
+ * exist. The name maps to the VMwareVCenter model's `name` column. The
+ * shipped VMware alert templates group by the vSphere object's own
+ * resource attribute (`resource.vcenter.host.name`,
+ * `resource.vcenter.vm.name`, `resource.vcenter.datastore.name`, ...),
+ * so their series labels do NOT carry these keys; the deterministic
+ * vCenter link for those monitors comes from the monitor step config
+ * instead (see MonitorResourceContext). These keys cover user-built
+ * monitors that group by the vCenter attribute.
+ */
+export const VMwareVCenterNameLabelKeys: ReadonlyArray<string> = [
+  "resource.vmware.vcenter.name",
+  "vmware.vcenter.name",
+];
+
 /*
  * IoT fleet identity rides the agent-stamped resource attribute
  * (`iot.fleet.name`) and its ClickHouse `resource.`-prefixed twin.
@@ -188,6 +208,7 @@ export const AllResourceIdentityLabelKeys: ReadonlyArray<string> = [
   ...KubernetesClusterIdLabelKeys,
   ...KubernetesClusterNameLabelKeys,
   ...ProxmoxClusterNameLabelKeys,
+  ...VMwareVCenterNameLabelKeys,
   ...CephClusterNameLabelKeys,
   ...IoTFleetNameLabelKeys,
   ...ServiceIdLabelKeys,
@@ -212,6 +233,7 @@ export interface SeriesResourceRefs {
   kubernetesClusterNames: Array<string>;
   dockerSwarmClusterNames: Array<string>;
   proxmoxClusterNames: Array<string>;
+  vmwareVCenterNames: Array<string>;
   cephClusterNames: Array<string>;
   iotFleetNames: Array<string>;
   serviceIds: Array<string>;
@@ -288,6 +310,10 @@ export default class SeriesResourceLabels {
         seriesLabels,
         ProxmoxClusterNameLabelKeys,
       ),
+      vmwareVCenterNames: this.collectLabelValues(
+        seriesLabels,
+        VMwareVCenterNameLabelKeys,
+      ),
       cephClusterNames: this.collectLabelValues(
         seriesLabels,
         CephClusterNameLabelKeys,