Improper alarm messages from the ICMP probe when using alarm policy and enrichment

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

We are receiving false alarm and improper alarm messages for the ICMP probe when using MCS Alarm policy for time Over Threshold alarm messages. (ToT)

This alarm message issue is occurring not only with one single alarm policy - it affects all hubs running the ICMP probe.

We tried restarting the services and probes, but nothing worked.

Environment

• DX UIM 23.4 CU2
• alarm_enrichment
• MCS Alarm policy (ToT)

Cause

• SELECT statement parameters needed adjustment to prevent alarm message truncation

Resolution

Example truncated alarm message (IP address was truncated):

   <example_FQDN> Unpingable XX.XX.XXX is Unpingable at 0.00 pct. It has violated the threshold for at least 21.0 minutes

• The alarm message does NOT have to be as long as it is currently specified in the SELECT query 999, so we changed it to 200.

• We also changed the starting substring character from 24 to 1.

• This data comes from the message column in the custom table 'View'-> uim_alarm_view

• Once we changed the query from:

  • SELECT SUBSTRING(?, 24,999) as finalmsg

    • to->

  • SELECT SUBSTRING(?,1,200) as finalmsg

• Then we restarted the icmp probe, and the source/IP address truncation issue was resolved