Make SOI show informational alerts

[Daniel Blanco]

So we just went thru a re-vamp of our UIM alerts and we changed the severity of alerts across the board on every probe. We now are generating "Informational' alerts and I immediately knew SOI doesn't show "Informational" alerts OOTB. Is there a way to get it to show Info alerts or no?

[Shaheen Ahmed]

Hi Dan,

The informational alerts don't get published to SOI manager and there are good reason for that. First of all the flood of informational alerts can take down SOI manager and secondly from service management point of view informational alert don't have any value. If you still want to do it then you have to live with the risk as well. The only way I know to publish the informational alerts to SOI is to change the "<mapentry mapin='1' mapout='Informational' /> " to "<mapentry mapin='1' mapout='Minor' />  or change the mapout value to some other severity above minor. You'll have to recycle the connector after saving the change.

Thanks

Shaheen

[Daniel Blanco]

Thanks Shaheen. Actually it's not the Informational alerts we need but it's actually the Warning messages in UIM.

Today on the SOI console we see the Criticals, Majors, Minors but not the Warnings and no Informationals.

 

Which file on the connector boxes  handles the severity mapping? Is it in the connectors main policy file?

[Shaheen Ahmed]

Hi Dan,

Yes the main policy in CA\Catalyst\CatalystConnector\registry\topology\physical\<host name>_CatalystConnector\modules\policy folder. Search for severity or informational you'll see the mapping.

Thanks

Shaheen

[Fishman]

I was just looking at this, warnings are mapped to minor by default so you should see them if you didn't change anything, I spotted a few, it's just there isn't a separate status for Warning.  I'm guessing if you changed the mapping to use Warning as the text they would get dropped.  Not sure...

[Michael Boehm]

Hi,

you are nearly correct with your assumption for Warning Alerts:

SOI does not know of a Severity level "Warning".  It knows Normal, Minor, Major, Critical, Fatal.

Everything else will be classified as "unknown" by default.

 

And then the contingency of SOI kicks in, to map "unknown" Alerts to a given severity level, which you can customize in the SOI Settings.

 

To know exactly what happens, you should better map the original Alerts to one of the existing Severity levels.

 

MichaelBoehm

[Daniel Blanco]

Hi Shaheen_Ahmed, following up on this I see in the connector policy in the alert section the mapping:

 <!-- ======Event Class====== -->
 <EventClass name='Alert'>
    <Normalize>
       <Field output='Severity' outputtype='ref' type='map' input='level'>
          <mapentry mapin='5' mapout='Critical' />
          <mapentry mapin='4' mapout='Major' />
          <mapentry mapin='3' mapout='Minor' />
          <mapentry mapin='2' mapout='Minor' />
          <mapentry mapin='1' mapout='Informational' />
          <mapentry mapin='0' mapout='Normal' />
          <mapentry mapin='.*' mapout='Unknown' />
       </Field>
       <Field output='AlertType' outputtype='ref' type='map' input='severity'>
          <mapentry mapin='.*' mapout='Risk-Fault' />
    </Field>
 </Normalize>

So SOI cannot display Warning messages as their own severity level in SOI just able to map the Warning and Info alarms to Minors. Is it possible to add a Warning severity to SOI?

 

 

Or I know this might require L2 development changes.  

 

Another approach then is it possible to map the Severity coming into SOI from the UIM connector to say an alerts's UserAttribute column 5 and then just enter the severity text: Critical / Major / Minor / Warning / Informational

and I can then modify the Alarm Queue to show only specific alerts based on these severity levels contained in UA5?

 

Would it be the same mapping structure and the output would be userAttribute5?

 

 

Very weird I'm trying this out in my policy but nothing I map to userAttribute6-10 works. 1-5 works just fine but 6-10 are not getting the updated policy details?

As a test i put this:

 

<Field output='userAttribute5' format='{0}' input='robot' />
<Field output='userAttribute6' format='{0}' input='robot' />

 

UA5 gets populated but UA6 stays empty.???

[Daniel Blanco]

Okay confirmed this is an issue/bug or maybe a limitation on the Catalyst version I'm using with my GA UIM Connector but i cant map anything to UA6-10 from w/in the policy. 

 

But what I want to try is taking the severity from the alarm in UIM and map its severity value into UA4 to show its severity w/in the UA4 column even though it will map to a MINOR in SOI. 

 

I'm trying:

<EventClass name='Alert'>

...

<format>

.....

<Field output='userAttribute4' outputtype='ref' type='map' input='level'>
<mapentry mapin='5' mapout='Critical' />
<mapentry mapin='4' mapout='Major' />
<mapentry mapin='3' mapout='Minor' />
<mapentry mapin='2' mapout='Warning' />
<mapentry mapin='1' mapout='Informational' />
<mapentry mapin='0' mapout='Normal' />
<mapentry mapin='.*' mapout='Unknown' />

</format>

 

but that just gives me a 'format' in the UA4 column? Would this go in the format section or somewhere else?

[Daniel Blanco]

okay the following is getting me the # of the level which correlates to the severity value:

<Field output='userAttribute4' format='{0}' input='level' />

 

which is giving me a 2,3,4 or 5

 

So as a connector policy example here how do you write so that it assigns UA4 to the "***"

if level = 2 write  "warning"

            =3 write "Minor"

            =4 write "Major"

            =5 write "Critical"

 

I tried checking out the Connector Policy Example but those are super complicated:

Connector Policy Examples - CA Service Operations Insight - 3.2 - CA Technologies Documentation 

[Michael Boehm]

Hi Dan,

 

firstly, it is not possible to add a new Severity level of Warning to SOI.

This would require code changes everywhere in the system to handle this new level.

 

Your first coding of mapping the levels 0-5 to Normal-Critical is totally correct, BUT you have to keep that block in the Normalize section (like the block for mapping Severity).  You seem to have added this block to the Format section, where the system does not understand that syntax.

As a side remark: I don't understand why there is a default mapping to Informational, because SOI does not know about this level (it will be considered unknown and then being remapped according to the defined rules - see my previous post). This seems to be an error in the policy - I will follow up on that.

I will also follow up on the missing UA6-10, I am not aware of those not working.

 

Let me know if this helps you coding the expected result.

 

MichaelBoehm

[Daniel Blanco]

Hi Michael,

No still I am not getting that UA5 column populated correctly. I am getting the level # and want to know how to map that to the text of the corresponding severity?

 

Also did you test if you can populate the UA6-UA10 columns? I am using the Global Delivery UIM Connector and not the GA UIM Connector. 

[Michael Boehm]

Hi Dan,

 

can you please post your policy, or send it to me ([e-mail]).  There might be something wrong in the assignment for UA5.

The GD UIM Connector might not support UA6-UA10, because those UAs were added later to SOI.  You can open an Issue fort that, but I assume it will be marked as "Enhancement Request".

MichaelBoehm