Alarms from an EI connector contains "an increasing number and Severity value:" at the end of each message, example: ".8609320 Sev:".
All other alarms from other connectors do not have this issue.
The summary message field is correct, its only the message field contains this issue.
This issue most likely has two possible root causes:
1. The enrichment policies are modifying the message.
2. The message is being modified from the alarm source.
After reviewing the eitransform.log files for a handful of the problem Alerts, it appears that none of the Event Enrichment policies are changing the Description(Message) and the message is coming from Source itself.
The behaviour we have seen only affects alerts from the EI connector have and that's because it’s coming directly from the source. The log shows from the beginning of the event coming into SOI, through to the end of enrichment and at no point do any policies modify these messages adding an "an increasing number and Sev:".
You will need to investigate this further on your end at the message source.