messagegtw probe variable not reflecting what's on the Alarm Console

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)
• Unified Infrastructure Management for Mainframe

Issue/Introduction

We use the messagegtw probe in order to generate events in Service Now Event Management for a while now. That all works fine. One of the requests we got recently was to add the alarm id from the alert and map it to one of the event fields. We have done that and we are able to get the nimid to show, however it does not match the current alarm in the alarm console. So an alarm will generate and the messagegtw probe will create an event in servicenow using this payload:

record:

[{"description":"${message.udata.message}","node":"${message.udata.hostname}","type":"${device.probe}","resource":"${ci.description}","message_key":"UIM${message.udata.supp_key}${message.udata.hostname}${device.probe}${message.udata.subsys}","severity":2,"metric_name":"${metric.description}","source_instance":"${message.udata.subsys}","source":"UIM","ci_type":"${ci.type}","time_of_event":"${message.udata.nimts}","event_class":"${message.udata.subsys}","additional_info": {"nms_domain":"${message.domain}","nms_hub_name":"${message.udata.hub}","nms_origin":"${message.udata.origin}","subsystem_id":"${message.udata.sid}","nms_source":"${message.udata.source}","subsystem":"${message.udata.subsys}","supcount":"${message.udata.suppcount}","user_tag1":"${message.udata.user_tag1}","user_tag2":"${message.udata.user_tag2}","ci.name":"${ci.name}","os_version":"${cs.os_version}","os_description":"${cs.os_description}","maint_value":"${cs.maintenance}","device_ip":"${device.ip}","device_name":"${device.name}","supression":"${message.udata.supp_key}","cs_dediacted":"${cs.dedicated}","id":"${message.nimid}"}}]

You will see in the payload in bold the last variable we are mapping is a field called ID and populating it with the alarm variable message.nimid.

However when we do that we will look at the alarm on the alarm console and the ID field in the alarm console will NOT match the ID field in the event that was created for that specific alarm it will be completely different. How can we achieve this so that the NIMID that is mapped will match?

Environment

Release : 20.4

Component : UIM - MESSAGEGTW

Resolution

Match the alarm suppression key as this should be the same on both the Operator Console (OC) and Service Now. As these are events, the nimid changes when the event goes though different phases, e.g., alarm_enrichment.