search cancel

In Moogsoft alarms coming from UIM show a different severity

book

Article ID: 254136

calendar_today

Updated On:

Products

DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

We integrated UIM and Moogsoft, but we have noticed that the severity of the alarms is different in Moogsoft.

Apparently it is related to the fact that the 'pri' field on the alarms is coming differently for the same type of alarms when the device is configured using MCS or IM.

Using MCS

{"policy_id":"34","level":"2","pri":"1","subject":"alarm","...}

Using IM

{"level":"2","pri":"2","subject":"alarm",...}

Environment

Release : 20.3

Cause

As explained in EMS documentation, the 'pri' field is deprecated and only 'level' should be used to determine the alarm severity

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/ca-unified-infrastructure-management-probes/GA/monitoring/infrastructure-core-components/ems-event-management-service/ems-event-handling-and-emmessage-structure.html 

https://api-broadcom-ca.wolkenservicedesk.com/attachment/get_attachment_content?uniqueFileId=P/hOkpQspJRfEt90XTjGZA==

Resolution

In the alarm the field 'pri' is deprecated. 'level' should be used instead to determine the alarm severity,

'pri' is not really used by UIM. All probes and SDK now should be submitting 'level' as severity.  

If 'level' is not present then 'pri' will be used, but you will almost never see one without 'level' these days

As per Moogsoft documentation, it seems they still use 'pri', which would explain the discrepancy.

https://docs.moogsoft.com/Enterprise.8.0.0/configure-the-ca-uim-lam.html