DX Unified Infrastructure Management

Is it possible to manipulate an alarm in UIM, so that when the threshold of a metric is broken before it displays the alarm to the console the hostname is manipulated to what exactly I want it to be when it is finally visually seen in the alarm console and will use that hostname from there on out for the rest of the life of that specific alarm?

EX) So if I have a small table like this below:

APPID      HostName         UpdatedHostName

---------------------------------------------------------------------

18               tstserv01             tstserv01-111

34               tstserv03             tstserv03-121

The threshold of a metric would be broken and the hostname of the object would be used to search the table, or array or list or whatever you like. Then if/when a matching is found in the "HostName" column Than its "UpdatedHostName" would be used to populate the hostname field on the alarm and it would alarm on the console as it should with the rest of its proper information.

Has anyone ever done something like this, or is it possible?

So usually the update information would be stored in a database and alarm_enrichment would be used to update this with the new information.

You can also use pre-processing lua scripts or an AO script to update the host field

you can see the strucutre in the below documentation

Language Extensions - CA Unified Infrastructure Management Probes - CA Technologies Documentation 

Gene I have done this and sounds like a good idea. I went and and set this up. However it seems I am running into something. Se we are using REST API calls to send information from another app to our alarm console when its alarming. So when we have an alarm from that tool it sends to our alarm console in UIM properly which does work fine for us. It seems though when I am looking through the alarm_enrichment probe logs I can see different alarms being checked against the different enrichment rules we have setup, except I do not see the alarms that we are sending to the alarm console via REST API. Should these still be able to be enriched by the probe? Is this by design that alarms that are created from REST API call can't be enriched or is this just something I have setup wrong?

I believe this is using a call back directly to the NAS probe to create the alarm and this process bypasses the alarm_enrichment probe as it is not a message on the message bus where the alarm_enrichment probe pulls alarms from other probes from.

Gene,

I actually got this to work, it was just in our setup the rule had to be on the primary hub. Once I moved my rule and started working out of the nas and alarm_enrichment probe on the primary hub this started working just fine. Thanks for your help

Hi rtirak,

Could you please share some details how you achieved it, like how alarm enrichment rule was built and using which database with this enrichment information was populated.. 

Regards

Hitesh Sehgal

Hsehgal

Sure can, 

What I did was create a second small DB on the the same Server that holds our UIM DB. Does not have to be just that's how I did it. Than I created a table that holds the hostnames that I want to look for and its corresponding UpdatedHostnames kind of looks like the example above. 

Then I used this documentation to create the different keys needed in the nas probe for enrichment-source and enrichment rules to query the table when an alarm comes in. It queries the alarm hostname against the list in the db table. If it finds a match it uses its updatedHostname and added it to the Custom_3 Field and than writes the alarm to the console that way we can do what we want with the alarm from there.

Here is the full document link referenced above:

How to use the nas and alarm_enrichment probes to enrich alarms 

Thanks Robert for sharing this info