An architecture for sorts and bucketizes alerts in a virtualization environment. A plurality of alerts associated with virtual machines in the virtualization environment is received. A plurality of attributes is identified for the virtual machines, and a plurality of buckets defined for each attribute, into which the received alerts are assigned. The buckets for each attribute are then sorted. The attributes may also be sorted based upon the distribution of alerts in the buckets of the attribute, allowing a system administrator or other personnel to more easily determine which attributes of the virtual machines are correlated with the received alerts, in order to identify potential causes and solutions for the alerts in the virtualization environment.