The newest releases of Spectrum and UIM support a bi-directional integration between Spectrum and UIM.
As mentioned in several different Community posts, a group is working on a "Best Practices Document" to explain different scenarios of integrating the three tools, and what the best methods are for each scenario. There is no global Best Practice, because it depends on what you want to achieve with this triple integration.
One of the many Use Cases is to synchronize the Alerts between the tools, e.g. you see the UIM Alerts on the Spectrum Console, and the Spectrum Alerts on the UIM Console. But if you also have SOI integrated with Spectrum and UIM via the two Connectors, you will get duplicate Alerts in the SOI Console.
Following I am providing a mechanism to block the UIM Alerts which are forwarded via the Spectrum Connector, and the Spectrum Alerts forwarded via the UIM Connector.
As mentioned, this is only one part of the global picture to integrate Spectrum-UIM-SOI, but according to my knowledge the most "disturbing" part if you get duplicate Alerts.
This method is not related to any other Use Case of the integration, such as Root Cause Analysis, Repository Synchronization, etc. It solely filters the Alerts.
UIM-SOI Connector Configuration
To block the Spectrum Alerts which are forwarded to SOI via the UIM Connector, you have to add a Filter condition in the UIM Connector Policy.
Alerts coming into UIM from Spectrum are processed by the Spectrum Gateway Probe. Thus, this can be used as the criterion to identify these Alerts.
Within the EventClass "Alert" of the UIM Connector Policy add the following block:
<Filter>
<Field input="prid" pattern="spectrumgtw" type="exclude" />
</Filter>
Then restart the UIM Connector.
All new Alerts coming from Spectrum via UIM will then be blocked for forwarding to SOI.
Spectrum-SOI Connector Configuration
To block the UIM Alerts which are forwarded to SOI via the Spectrum Connector, you have to add a Filter condition in the Spectrum Connector Policy.
Alerts in Spectrum got a new attribute, called Source (attribute id 0x00013342). The values are as follows:
0 Spectrum
1 EMS
2 NAS
3 UIM
This can be used as the criterion to identify these Alerts, but prior to being able to make use of this attribute in the Connector policy it has to be added as additional attribute.
Within the <Alarms> block of the configuration file AdditionalAttributes.xml, of the Spectrum Connector add the following:
<Alarms>
<Attribute id="0x00013342" name="Source"/>
</Alarms>
Then the attribute Source will be available in the Spectrum Connector.
Within the EventClass "Alert" of the Spectrum Connector Policy add the following block:
<Filter>
<Field input="Source" pattern="^1|2|3$" type="exclude" />
</Filter>
Then restart the Spectrum Connector.
All new Alerts coming from UIM via Spectrum will then be blocked for forwarding to SOI.
Further References
Location of UIM Connector Policy (Catalyst-based) nimsoftconnector_policy.xml
...\CA\Catalyst\CatalystConnector\registry\topology\physical\<server>_CatalystConnector\modules\policy
Location of Spectrum Connector Policy (IFW-based) spectrumim_policy.xml
...\CA\SOI\resources\Core\Catalogpolicy
Location of Spectrum Connector Configuration File AdditionalAttributes.xml
...\CA\SOI\resources\Configurations\SpectrumIM
Please let me know if this is helpful for this specific Use Case and if more detailed information is required.
In case of problems you can also reach me directly: Michael.Boehm@ca.com.
MichaelBoehm