Hi All,

I am looking for some documentation that describes in detail with examples how to use the spectrum_alarm_filters and uim_alarm_filters that exist in the latest version of the UIM/SPECTRUM gateway probe version 8.64.  I read the spectrum AC Configuration guide on docops. Worthless. We need to step by step instructions with some examples for this probe to be usable. Anyone already using this feature please share what you can.

TIA

Hi Patrick, The below steps have been provided by a colleague who tested the filters, In the spectrumgtw probe.

In this example, we are trying to set up an alarm filter with an example of a rule to prevent the spectrumgtw probe from synchronizing UIMS "Robot <name> is inactive" alarms with Spectrum.

1. From the spectrumgtw Configure Page in Admin Console, expand the Alarm Filters folder, then select the uim_alarm_filters folder from the left-hand pane.
2. Select "all" for the AND/OR option if you want to synchronize alarms that match all of the defined filters. If you select the "any" option then alarms that match any defined filter will be synchronized.
3. You need to select Active to active the set of defined filtters and the AND/OR option you configure for these filters
4. For each filter you want to define, select the new option in the Filters list
5. Give you new filter a name in the "Filter Name" field
6. For the attributes option, you will have a drop down list of available attributes that you can filter on in a UIM alarm. One of those is the message attribute. Select this attribute.
7. Based on the attribute selected, you will get a drop down list of available operators that are applicable to the selected attribute. To ignore "Robot <name> is inactive" messages, the option you would want to select here is "DoesNotEndWith"
8. For the Value field you have to enter a case sensitive string and you cannot use any wild card characters to match strings. Therefore, you would want to specify the string "is inactive" for the Value (do not include the quotes in the Value field.

This rule will match any alarm message that does not end with the string "is inactive" thereby excluding your "Robot <name> is inactive" alarms. The matched alarms should be synchronized with Spectrum and the unmatched alarms ignored.

You have to be very careful with your logic and the specification of the AND/Or operation you wish to use with the filters that you generate. Developing a comprehensive set of rules for sending alarms can get very complex and you need to work through the logic that you build with the set of filters you define.
From the Attributes drop down list, you can see that in addition to matching on the message contents, you can also match on other parts of a UIM alarm such as:
Assigned To
Hostname
Level
Source

Note that you can also set up alarm filters to control the Spectrum alarms that are synchronized and displayed in the UMP USM Alarm view in a similar manner and separately from the UIM alarm filters.
Hopefully this better explains how you would set up alarm filters, in the spectrumgtw probe.

Hi Marco,

Thanks for the input. I was able to accomplish this filter yesterday with the help of Kathy. The problem I ran into afterwards was that I was trying to filter out all Minor and Major alarms. Starting fresh with no other rules in the filter I created two rules.

  1.  Name – major, Attributes - level, Operator – notEqualsTo, value – 1, enable – true

  2.  Name – minor, Attributes - level, Operator – notEqualsTo, value – 1, enable – true

Set to: active

Required and/or set to :

Any – nothing happens

All – nothing happens

Any Ideas why this will not work?

Patrick

Hi Marco ,

Never mind I just found out :

I was told, If you wish to exclude major and minor alarms then you have to use the correct UIM severity alarm levels.  That would be level 3 for minor and level 4 for major alarms.

I guess it helps to know what the correct level is on the UIM side. I was looking at the alerts on the Spectrum side and in the component detail of the alarm a Minor is a "1", and a Major is a "2".

Patrick

Okay, I got all the filters working. But have discovered a problem between UIM and Spectrum. It appears that in the Spectrum alarm screen below is not reflecting the alarms correctly when received on Spectrum. Usually in Spectrum individual alerts for the same server appear as their own separate alert. But as seen below the alerts even though they reference different disk’s are being stacked under the one alarm. Usually, this only happens in Spectrum when an identical alert for the same identical CI comes in then it will stack as a repeat alarm. Any Ideas?

Patrick

Hi 

Please check below TEC if this helps 

UIM alarms displayed as single alarm with multiples occurrences in Spectrum side