Specific Nimsoft alert is missing from SOI console

Document ID : KB000095601
Last Modified Date : 15/05/2018
Show Technical Document Details
Issue:
All Nimsoft alerts are showing up on the SOI console except for one kind of specific alert. 
Cause:
One Event Management policy file in "CA\Catalyst\CatalystConnector\container\data\Core\Catalogpolicy\extensions" folder on the UIM connector machine was getting triggered by the missing alert and the policy file was excluding the missing alert from publishing to SOI. 
Resolution:
- Stop the CA Catalyst Container CatalystConector service on the UIM connector machine
- Remove the event management policy file in question from "CA\Catalyst\CatalystConnector\container\data\Core\Catalogpolicy\extensions" folder 
- Start the CA Catalyst Container CatalystConector service on the UIM connector machine
Additional Information:
To find out how the missing alert was triggering the EM policy
- Set ei transfomer debug in in container\etc\log4j-ei.properties file on the following two lines as you see below
   log4j.logger.com.ca.eventplus.catalog=DEBUG, Transformer
   log4j.logger.com.ca.eventplus.catalog.test=DEBUG, Transformer
- You may have to recycle the Catalyst Container service.
- The debug will add debug messages in ei-transformer.log file in container\data\logs folder.
- Once the missing message appears on the UIM alert console you can look in to the ei-transformer.log searching for the nimid of the alert.     The following entry in the log file shows it is matching the Event Management policy file
   "EPEVENT.filterEvent:policyname:<name of the policy file>"
    Couple of lines down you'll notice folloiwng message that tells you the policy is triggering
    "Evaluator.Evaluat:Rules fired = 1"