All Nimsoft alerts are showing up on the SOI console except for one kind of specific alert.
One Event Management policy file in "CA\Catalyst\CatalystConnector\container\data\Core\Catalogpolicy\extensions" folder on the UIM connector machine was getting triggered by the missing alert and the policy file was excluding the missing alert from publishing to SOI.
- Stop the CA Catalyst Container CatalystConector service on the UIM connector machine
- Remove the event management policy file in question from "CA\Catalyst\CatalystConnector\container\data\Core\Catalogpolicy\extensions" folder
- Start the CA Catalyst Container CatalystConector service on the UIM connector machine
To find out how the missing alert was triggering the EM policy
- Set ei transfomer debug in in container\etc\log4j-ei.properties file on the following two lines as you see below
- You may have to recycle the Catalyst Container service.
- The debug will add debug messages in ei-transformer.log file in container\data\logs folder.
- Once the missing message appears on the UIM alert console you can look in to the ei-transformer.log searching for the nimid of the alert. The following entry in the log file shows it is matching the Event Management policy file
"EPEVENT.filterEvent:policyname:<name of the policy file>"
Couple of lines down you'll notice folloiwng message that tells you the policy is triggering
"Evaluator.Evaluat:Rules fired = 1"