UIM alarms displayed as single alarm with multiples occurrences in Spectrum side

Document ID : KB000006739
Last Modified Date : 28/02/2018
Show Technical Document Details
Issue:

Multiples CDM alerts coming from CA UIM are being created as a single alarm with multiples occurrence in CA Spectrum side.

Multiples alarms are expected in CA Spectrum because those are from different file systems.

UIM_multiple_alarms_and_single_alarm_in_Spectrum.png

Environment:
CA Spectrum 10.2.1, and 10.2.2 & CA UIM 8.51
Cause:

Event Variable Discriminators was not set for the 0x63300cc event code.

Resolution:

This is resolved in 10.2.3 release and in the following patches for releases prior to 10.2.3:
10.2.1 - Spectrum_10.02.01.PTF_10.2.168
10.2.2 - Spectrum_10.02.02.PTF_10.2.213

Using the UIM AlarmID as Event Variable Discriminators for all CA UIM event codes in Spectrum_10.02.01.PTF_10.2.168 and Spectrum_10.02.02.PTF_10.2.213 patches and in CA Spectrum 10.2.3. 
 

Additional Information:

Workaround suggested prior Spectrum_10.02.01.PTF_10.2.168 patch:

We need to make changes to the EventDisp file located at $SPECROOT/SS/CsVendor/gen_app_gw/ directory. 

Add Alarm ID attribute at the end of the following entry: 0x063300cc A { v 101 Nimsoft.UIMSeverity },0x063300cc

This is what you should have: 0x063300cc A { v 101 Nimsoft.UIMSeverity },0x063300cc,0x13344  

Reload the event configuration files.

* To update the overall alert and event system more broadly for a given landscape, in OneClick, click the Update Event Configuration button that is available on the SpectroSERVER Control subview of the Information tab on the VNM model.

OR

* Update action=0x100a2 mh=<VNM modelhandle>

Important! This update process flushes and reloads all event rules including those that are in the middle of processing. As a consequence, the processing of events by active event rules is aborted, and all associated data (for example, counts for occurrences of contributing events) is lost.