Json and TMF Alarm Message Format - Spectrum Oneclick with Kafka Integration

Products

• Network Observability

Issue/Introduction

Spectrum and Kafka integrated messages are sent to Third Party Tool Netcool

When used TMF format the payload shows the Attributes and Values are in proper format

TMF Payload
{
"id": "123f4567-123d-123b-4567-12345678e123",
"href": "https://server62:8443/spectrum/webapp?alarm=123f4567-123d-123b-4567-12345678e123",
"ackState": "acknowledged",
"ackUserId": "server84",
"alarmChangedTime": "2025-07-22T13:27:07.000Z",
"alarmDetails": "DEVICE HAS STOPPED RESPONDING TO POLLS",
"alarmRaisedTime": "2025-07-22T13:20:36.000Z",
"alarmReportingTime": "2020-11-21T13:29:59.000Z",
"alarmType": "DEVICE HAS STOPPED RESPONDING TO POLLS",
"externalAlarmId": "123f4567-123d-123b-4567-12345678e123",
"perceivedSeverity": "critical",
"reportingSystemId": "server84",
"sourceSystemId": "SPECTRUM",
"specificProblem": "DEVICE HAS STOPPED RESPONDING TO POLLS",
"state": "updated",
"alarmedObject": {
"id": "0x11001a33",
"href": "https://server62:8443/spectrum/webapp?explorer=0x11001a33"
},
"modelTypeHandle": "0x171000f",
"modelTypeName": "AristaSwitch",
"causeCount": "0",
"symptomCount": "0",
"condition": "3",
"impactTypeList": "6",
"precedence": "10",
"capcItemId": "8234",
"userClearable": "false",
"lastOccurrenceDate": "1753186836",
"syslogHitCount": "0",
"deviceType": "Arista-64",
"contactPerson": "",
"manufacturer": "Arista Networks, Inc.",
"occurrences": "1",
"managementLostImpact": "\nServer058 (0x11001a29,Critical)\nServer054 (0x11001a33,Critical)
\nServer057 (0x11001f87,Critical)\nServer091 (0x11259dfd,Critical)\nServer040 (0x11259e05,Critical)
\nServer041 (0x31259f02,Critical)",
"causeCode": "65545",
"emsModelHandle": "0x11001a33",
"troubleShooter": "User1",
"sysName": "Server054 ",
"globalCollectionName": "GC1",
"isManaged": "true",
"topologyName": "Universe",
"modelClass": "4",
"modelName": "Server054 ",
"originatingEvent": "Device Server054  of type AristaSwitch has stopped responding to polls and/or external requests.  An alarm will be generated.",
"networkAddress": " 1.1.1.35"
}

When changed the format to JSON the Attributes also following the hierarchy as
notification-list-added-instance-alarm-attribute-content
notification-list-added-instance-alarm-attribute-id
notification-list-added-instance-alarm-id

JSON Payload
 
"notification-list": {
"added-instance": [
{
"alarm": {
"attribute": [
{
"content": "0x220011",
"id": "0x10001"
},
{
"content": "Gen_IF_Port",
"id": "0x10000"
},
{
"content": "***1_User ***",
"id": "0x11f82"
},
{
"id": "0x12a05"
},
{
"id": "0x12a04"
},
{
"content": "0",
"id": "0x12a07"
},
{
"content": "0",
"id": "0x12a06"
},
{
"content": "1",
"id": "0x1000a"
},
{
"content": "10",
"id": "0x12c0a"
},
{
"content": "670941",
"id": "0x13214"
},
{
"content": "true",
"id": "0x11f9b"
},
{
"content": "1753187547",
"id": "0x1321a"
},
{
"id": "0x1341d"
},
{
"content": "123f45db-1d02-1002-0567-12345678e123",
"id": "0x11f9c"
},
{
"content": "0",
"id": "0x1341f"
},
{
"id": "0x1341e"
},
{
"id": "0x13421"
},
{
"id": "0x13420"
},
{
"id": "0x13423"
},
{
"id": "0x12022"
},
{
"content": "Cisco Nexus",
"id": "0x23000e"
},
{
"content": "536870912",
"id": "0x129ac"
},
{
"content": "Hall 2",
"id": "0x23000d"
},
{
"content": "NOC",
"id": "0x23000c"
},
{
"content": "Cisco Systems, Inc.",
"id": "0x10032"
},
{
"content": "14223",
"id": "0x11b41"
},
{
"content": "Server7596",
"id": "0x11d42"
},
{
"content": "0",
"id": "0x13342"
},
{
"content": "1",
"id": "0x11fc5"
},
{
"content": "0",
"id": "0x13345"
},
{
"id": "0x12dc7"
},
{
"content": "false",
"id": "0x11f4d"
},
{
"content": "IN LOAD THRESHOLD EXCEEDED [NET_INT] Model Type = Gen_IF_Port, Name = SERVER_Ethernet1/8",
"id": "0x12b4c"
},
{
"content": "1753187547",
"id": "0x11f4e"
},
{
"content": "69123",
"id": "0x11f50"
},
{
"content": "0x2000b6bf",
"id": "0x11f53"
},
{
"id": "0x11f57"
},
{
"content": "1",
"id": "0x11f56"
},
{
"id": "0x12adb"
},
{
"content": "true",
"id": "0x1295d"
},
{
"content": "Universe",
"id": "0x129e7"
},
{
"content": "0x2000140d",
"id": "0x10069"
},
{
"content": "15",
"id": "0x11ee8"
},
{
"content": "Server_Ethernet1/8",
"id": "0x1006e"
},
{
"content": "Threshold Exceeded for IN LOAD for an unacceptable duration.  The threshold value is 2 %, and the current value is 2 %.  Model Type = Gen_IF_Port, Name = Server_Ethernet1/8.",
"id": "0x1296e"
},
{
"id": "0x12bf7"
},
{
"content": "0x2000b6bf",
"id": "0x129fa"
},
{
"content": " 1.1.1.124",
"id": "0x12d7f"
},
{
"content": "13",
"id": "0x5c40012"
}
],
"id": "123f45db-1d02-1002-0567-12345678e123"
},
"preexisting": false
}
]
}
}

 

Error Message reporting in Netcool.

2025-08-18T16:16:39: Error: E-UNK-000-000: [P2P] : Failed to read data message. (-27:Connection closed)

 

Is there any configuration file where we can map JSON format attributes also same as TMF

 

Environment

23.3.x 

24.3.x

Cause

TMF “format” is already JSON—it’s just a standardized TMF schema. The Netcool error points to a schema parsing mismatch, not a non-JSON message.

Resolution

TMF “format” is already JSON—it’s just a standardized TMF schema. The Netcool error points to a schema parsing mismatch, not a non-JSON message.

Recommendations:
1)
If Netcool needs readable field names and full context, the fastest option is to consume the TMF JSON and parse that schema

2)
Have the Kafka team to place a transform between kafka and Netcool to map attribute IDs -> names