list_anomalies
Rank VMs by total active anomalies (symptoms, events, violations) to identify the worst offenders, or scope to a specific resource for its anomaly count.
Instructions
[READ] Report per-resource anomaly counts (System Attributes|total_alarms metric).
The suite-api does not expose the UI's anomalous-metrics list; this is the
Total Anomalies metric — active symptoms, events and DT violations on the
object and its children. With resource_id: that resource's count. Without:
ranks every VM in the environment and returns the worst limit of them.
For root cause, follow up with list_alerts(resource_id=...).
limit bounds the answer, not the scan — raising it does not widen the
search, and lowering it does not hide worse objects. The whole inventory is
read either way, in bulk pages, because the ranking metric is not a field
the appliance can sort on.
Returns a paginated envelope: flagged rows worst-first under items, plus returned, limit, total, truncated, hint, scanned (objects examined), vm_total and scan_complete. Only flagged VMs are returned, so a short list is not by itself proof the environment is clean. When scan_complete is true, total is the number of anomalous objects found and truncated is exact; when it is false the scan hit its cap, total is the environment's VM count, and a note says the ranking is partial — an unexamined object could outrank every row shown.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum ranked rows to return (1–500). Default 50. Rejected, not clamped, when out of range. | |
| target | No | Aria target name from config; default when omitted. | |
| resource_id | No | Optional resource UUID to scope to a single resource. |