In Moogsoft alarms coming from UIM show a different severity

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

We integrated UIM and Moogsoft, but we have noticed that the severity of the alarms is different in Moogsoft.

Apparently it is related to the fact that the 'pri' field on the alarms is coming differently for the same type of alarms when the device is configured using MCS or IM.

Using MCS

{"policy_id":"34","level":"2","pri":"1","subject":"alarm","...}

Using IM

{"level":"2","pri":"2","subject":"alarm",...}

Environment

Release : 20.3

Cause

As explained in EMS documentation, the 'pri' field is deprecated and only 'level' should be used to determine the alarm severity

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/ca-unified-infrastructure-management-probes/GA/monitoring/infrastructure-core-components/ems-event-management-service/ems-event-handling-and-emmessage-structure.html 

Resolution

In the alarm the field 'pri' is deprecated. 'level' should be used instead to determine the alarm severity,

'pri' is not really used by UIM. All probes and SDK now should be submitting 'level' as severity.  

If 'level' is not present then 'pri' will be used, but you will almost never see one without 'level' these days

As per Moogsoft documentation, it seems they still use 'pri', which would explain the discrepancy.

https://docs.moogsoft.com/Enterprise.8.0.0/configure-the-ca-uim-lam.html

Additional Information

Oct 17 - Marco Ippati - Republished.