CDM higher severity alarm updates lower severity alarm
Article ID: 426094
Updated On:
Products
Issue/Introduction
When the CDM probe sends an alarm for the "low" disk threshold, this alert is generated as a Minor severity alert.
When the same device crosses the "high" threshold, a Major alert is generated.
This alarm updates the Minor alert, increasing the severity and updating the message, instead of appearing as a distinct and separate alert.
Can this be changed so that CDM sends a totally separate alert?
Environment
DX UIM - Any Version
CDM Probe - Any Version
NAS Probe - Any Version
Cause
This is related to Message suppression and is working as designed.
Message suppression is a feature used to avoid storing multiple alarms caused by the same problem. Alarms with the same source, message, subsystem and severity information will be suppressed into a single message with only a counter indicating the number of occurrences. The severity and message will be updated appropriately to reflect the most recent status/severity.
Previous status/severity information will be visible under the Alarm Transaction History/Historic Alarms.
Resolution
Alarm suppression - that is, the "combining" of events under a single alarm record - is a core part of UIM functionality.
It is not possible to disable suppression based on severity - it is possible to disable alarm suppression entirely, but this is not recommended, as it will cause many undesirable effects.
For example, if alarm suppression is disabled, then when a condition is no longer present (e.g. a full disk gets cleaned up), the alarm cannot be cleared, and all alarms would have to be cleared manually.
In the vast majority of UIM installations it is not appropriate to disable suppression.
Additional Information
Feedback
