ntevl alarms are being grouped together despite their event IDs being different

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

How can we control this so that individual alarms are generated when the event IDs configured in the profile are different? For example, 4000, 4001, 4002, 4003.

Environment

Release : 9.2.0

Component : UIM - NTEVL

Resolution

ntevl, set the Suppression Key, Optional Key to $event_id in the ntevl 'Event Selection' window.

Also, the following fields can be used to establish a cutoff point of generating the Alarm.

Setup > Profiles > Alarm/Post > Set Suppression Key, Optional Key 

- Time Frame: 1 min 
- Event Count: > 3 

To test it you can send some messages with the configured event ids but note that when using this Microsoft eventcreate utility it has to be less than 1000 for the event id just during the testing.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/eventcreate

eventcreate /T ERROR /ID 400 /d "Create event for testing"

Once you enable the Suppression Key under 'Alarm / Post' and add $event_id as the value, then separate/individual alarms will be generated and not grouped together - which causes the alarm count to increase, despite the event id's under Event Selection being different.