While supporting VMware Explore 2023 in Barcelona, a customer asked me, “What’s the difference between Proactive Findings and Diagnostic Findings in Skyline Advisor Pro and how are each one produced?”

So, I’d like to take this moment to elaborate more on my original blog that introduced Diagnostic Findings.

Proactive Findings are potential issues that could occur in your environment. They are identified in Skyline Advisor Pro to help you proactively resolve them before they become very costly and time-consuming problems to fix. These Findings are based on top KB articles, VMSAs/CVEs, configuration, and design best practices.

Proactive Findings are produced by the Skyline Collector, which does the following:

• Aggregates Product Usage Data from a supported endpoint On-Prem
• Sends that data to Skyline’s Analysis Platform
• Delivers the results as Proactive Findings in Skyline Advisor Pro

Proactive Findings come in several different Finding Types, including:

• Configuration – Findings that can be addressed with an updated configuration setting.
• Upgrade – Findings that can be addressed with a patch or upgrade.
• Troubleshooting – Findings that can be addressed with VMware Aria Operations (SaaS) Troubleshooting Workbench, where troubleshooting tasks can be performed.

Diagnostic Findings, on the other hand, are real issues in your environment, as evidenced by log data that Aria Operations for Logs reports from a supported endpoint. This means that your environment is actively being impacted and its remediation should be prioritized.

Diagnostic Findings are exclusively of the Troubleshooting Finding Type.

Please note that not all Troubleshooting Findings are Diagnostic Findings. This is largely based on the way that they are produced, which is through the analysis of logs with Aria Operations of Logs.

Note: Diagnostic Findings will have the letters “Diag” in its Findings ID.

To receive a Diagnostic Finding in Skyline, your Skyline environment must have Aria Operations for Logs deployed, where it:

• Monitors the logs of your supported endpoint for symptoms.
• Responds to the log query of the Skyline Collector with a count of objects that match a known condition.

This data is then sent to Skyline’s Analysis Platform where the results appear as Diagnostic Findings in Skyline Advisor Pro.

No Customer Identifiable Information (CII) is being collected by the Skyline Collector as part of the data analysis process.

Below is a screenshot of a Log Query that identifies environment symptoms and aligns with a known issue and a KB that resolves it.

No CII data is collected as part of the Data Collection Process.

You may be wondering if you can “get by” with just the Skyline Collector sending queries to Aria Operations for Logs, if Aria operations for Logs is monitoring the endpoint.

Not having the Skyline Collector directly monitor the supported endpoint will result only in Diagnostic Findings. To increase the resiliency and stability and security of your environment, it is recommended that the Skyline Collector is directly connected to the endpoint in order to produce Proactive Findings as well. Skyline Advisor Pro’s Automated Endpoint Detection feature can help ensure all of your supported endpoints are connected.

I hope this clarifies the key differences between Proactive and Diagnostic Findings. To get the maximum benefit from Skyline Advisor Pro, be sure to enable them both if you’re leveraging Aria Operations for Logs in your environments.