ntevl alarms are being grouped together despite their event IDs being different

book

Article ID: 205489

calendar_today

Updated On:

Products

CA Unified Infrastructure Management On-Premise (Nimsoft / UIM) NIMSOFT PROBES DX Infrastructure Management

Issue/Introduction

How can we control this so that individual alarms are generated when the event IDs configured in the profile are different? For example, 4000, 4001, 4002, 4003.

Environment

Release : 9.2.0

Component : UIM - NTEVL

Resolution

ntevl, set the Suppression Key, Optional Key to $event_id in the ntevl 'Event Selection' window.

Also, the following fields can be used for the establish a cutoff point of generating the Alarm.

Setup > Profiles > Alarm/Post > Set Suppression Key, Optional Key 

- Time Frame: 1 min 
- Event Count: > 3 

To test it you can send some messages with the configured event ids but note that when using this Microsoft eventcreate utility it has to be less than 1000 for the event id just during the testing.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/eventcreate

eventcreate /T ERROR /ID 400 /d "Create event for testing"

Once you enable the Suppression Key under 'Alarm / Post' and add $event_id as the value, then separate/individual alarms will be generated and not grouped together which increases the alarm count despite the event id's under Event Selection being different.