No alerts sent for IMP Devices (IM and Presence) from the cisco_ucm probe

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

We are monitoring CISCO Unity(System) and Call Manager(Voice/Video) using the cisco_ucm probe 2.10 and RTMT templates and everything works fine. Event are matched and alarms are received. 

The connection to the CISCO UCM End is unique for the 3 monitoring endpoints: CISCO Unity(System) +  Call Manager(Voice/Video) and IMP Devices (IM and Presence). Same Username and Password. Nevetheless, even though we receive alerts for System and Voice/Video we are NOT receiving alerts for the IMP Devices. The IMP events are written in the /var/log/active/syslog/CiscoSyslog but still the probe is NOT Sending any alarm from these IMS profile.

 

Environment

• DX UIM 23.4.* 
• cisco_ucm 2.10

 

Cause

The alam monitorig uses a clear text regex expression that can be found in the regex.txt file in the probe folder. 

/.*RTMT_ALERT: %\[AlertName=(?.*)]\[AlertDetail=(?.*)]/

This Regex works fine for Unity and Call manager as it matches the format, but for IMP alerts, it doesn’t match the exact format, so the alarms are not sent.  

Resolution

Replace the current regex by editing the regex file and replace with the below expression. 

 

(?|.*: .*: (?.*)\.\d{3} .* :  .*RTMT_ALERT: %\[AlertName=(?.*)]\[AlertDetail=.*]\[AppID=(?.*)]\[ClusterID=(?.*)]\[NodeID=(?.*)]: (?.*)|.*: .*: (?.*)\.\d{3} .* : .*-(?.*): %\[AppID=(?.*)]\[ClusterID=(?.*)]\[NodeID=(?.*)]: (?.*))

 

Using the above expression matches CISCO Unity(System) +  Call Manager(Voice/Video) + IMP (IM and Presence) alerts.

Additional Information

The next GA Version of the cisco_ucm probe will include the enhanced Regex by default.