spectrumgtw probe is clearing an active UIM alarm

Products

Network Observability Spectrum DX Unified Infrastructure Management (Nimsoft / UIM) CA Unified Infrastructure Management On-Premise (Nimsoft / UIM) CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

Alarm is generated by VMware probe in UIM and after 40-50 seconds the alarm still active in UIM but is deleted by the spectrumgtw probe.
This behavior is not observed for CDM alarms.

Spectrum alarm filter is being used:

     <spectrum_alarm_filters>
         required = all
         active = no
      </spectrum_alarm_filters>
      <uim_alarm_filters>
         required = any
         active = Yes
         <example-1>
            value = <server1_hostname>
            attribute = source
            filterName = example-1
            operator = Contains
            active = Yes
         </example-1>
         <example-2>
            value = <server2_hostname>
            filterName = example-2
            attribute = hostName
            operator = Contains
            active = Yes
         </example-2>
      </uim_alarm_filters>

In the alarm.log file:

2025-02-25 11:21:57,889 DEBUG pool-6-thread-1: [PartialRespBuilder] [addAlarmInDeleteMapIfFilterOut] - build() :: alarmType [UIM] , [RN13663222-08606] [CFG] Dose not pass the filter and will be deleted

Environment

Spectrum 23.3.13 - UIM 23.4.2
spectrumgtw 20.40/20.41 and 23.4.3
Integration direction: UIM to Spectrum (only)
vmware
Spectrum

Cause

The attribute source is causing the UIM alarm to be deleted.

Resolution

Changed the spectrumgtw alarm filter attribute from source to hostName in the spectrumgtw.cfg file:

<example-1>
value = <server1_hostname>
attribute = source
filterName = example-1
operator = Contains
active = Yes
</example-1>

<example-1>
value = <server1_hostname>
attribute = hostName
filterName = example-1
operator = Contains
active = Yes
</example-1>

Additional Information

IM Alarm Console 'source' is different from alarm source attribute value.

If we see customer debug logs below, printing alarm data received from UIM. spectrum is not getting source from UIM IM alarm console source,

For example UIM alarm below

===========================
2025-03-12 08:00:45,082 DEBUG SpectrumGtwScheduler_Worker-6: [AlarmProcessingController] [getUpdatedAlarmsForPartialSync] - alarm : Uim Alarm [ Alarm Id: UR52793935-37122 Troubleshooter: null Alarm Title: Average (3 samples) total cpu is now 100.00%, which is above the error threshold (90%).Top Processes [java.exe[1052]-(30.69%)-SYSTEM];[TiWorker.exe[5032]-(23.10%)-SYSTEM];[java.exe[4412]-(6.44%)-SYSTEM];[example.exe[3776]-(4.80%)-NETWORK SERVICE];[svchost.exe[832]-(1.50%)-LOCAL SERVICE] IP Address: ##.###.##.### Alarm Trouble Ticket Id: TargetProduct Alarm Id: null Alarm Manager : NAS Host Name : abc-example-02 Source product : NAS LandScape : null Alarm Source: NAS Primary IPV4 Address :##.###.##.### Alarm Severity: 4 Device Deleted Flag: false Information Warning Alarm deletion Flag: false Severity change for Informational or Warning Alarm: false Alarm severity change flagfalse Entity Id : DD5F78DD5348B2503FB4A731D5C24994D Custom 1 : Custom 2 : Custom 3 : Custom 4 : Custom 5 : UserTag 1 : UserTag 2 : MetricTypeId : 1.5:1 Status(CauseCount): ] ]==========================

Source product : NAS

Alarm Source: NAS
This is different from the UIM Alarm Console source value.

As per code and design, the spectrumgtw probe is looking at Source as Primary IPV4 Address, that should be populated in alarm record in UIM DB.

If IPV4 Address is correct Source IP address and populated for all alarms in UIM DB, please try to filter source with Primary IPV4 address value.

Please note that when tested locally in our lab, IPV4 Address is populating for some alarms, but not populated for other alarms.

Plese refer to the KB Article shwn below which recommends to use hostname as filter instead of source attribute.

spectrumgtw probe is clearing an active UIM alarm from VMware probe