Alarms generated via devices that would not necessarily be discovered in UIM, example a trap from the snmptd probe, or an echo failure from a device with the icmp probe. Looking at the oi_connector log with loglevel=5:
Jun 30 22:18:43:960 [ALARM_PROCESSOR_THREAD-2, oi_connector] Ignoring alarm as this group is not selected/or not belongs to any group : {"severity":"warning","ci_id":"<ci_id>","cs_key":"<cs_key>","cs_id":"101","metric_unit":"none","ci_type":"Network.Protocol.UDP.SNMP.SNMPTD","metric_name":"Network.Protocol.UDP.SNMP.SNMPTD:Trap","level":2,"ci_name":"SNMP v2 TRAP","metric_type":"2.2.3.2.1:3","met_id":"<met_id>","dev_id":"<dev_id>"}
Since the devices do not get completely discovered as their alarms are for sources that would not be fully discovered, and grouped in UIM.
Creating a new group in OC like 'TrapDevices', adding those devices that are alarming and then updating the oi_connector configuration to include this group for alarms:
In the case of the snmptd probe, where the sources would not be populated in Operator Console until a trap is received, it may be desired to prepopulate these devices if the network traffic for the devices is one way via cm_data_import. When doing this, you can set a description that can be acted upon once the device is imported to put it into the TrapDevice group that is/was created:
Note: The primary dns name should be the name you expect the trap sends as.