Jump to content

CA Unicenter NSM Textbook/Issues and Workarounds

Add links
From Wikibooks, open books for an open world

I thought I would share this with everybody given the effort that went into getting this to work.

What I wanted to do was raise alerts for a specific Storage Group / Mailstore going down using caiLogA2, and reset the trigger when that specific Storage Group / Mailstore came back up.


Event Type: Information
Event Source: MSExchangeIS Mailbox Store
Event Category: General
Event ID: 9539
Date: 16/07/2008
Time: 1:41:38 p.m.
User: N/A
Computer: NZWNLSSTEMP01
Description: The Microsoft Exchange Information Store database "test SG-1\Mailstore-1b" was stopped.


Event Type: Information
Event Source: MSExchangeIS Mailbox Store
Event Category: General
Event ID: 9523
Date: 16/07/2008
Time: 1:42:35 p.m.
User: N/A
Computer: NZWNLSSTEMP01
Description: The Microsoft Exchange Database "test SG-1\Mailstore-1b" has been started.


The specific identifiers in this case are the Event IDs and the Store nametest SG-1\Mailstore-1b


After much trial and error I have determined that the "\" is a special character that cannot be tolerated. Also the filters are sensitive to case and leading and trailing blanks.

So…

We use the following filter settings with .* being the wildcard marker replacing what we can do without. NOTE that it a dot and a star .*


Using Positive Pattern & Positive Toggle Pattern.


  • Rule name
  • SYSTEM_LOG\application
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*test SG-1.*Mailstore-1b.*
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*test SG-1.*Mailstore-1b.*
  • Per Poll
  • Toggled
  • Generate
  • Send



Now all I need to do is reproduce this for all the different Mailstores being very careful to match the spelling and character cases, and watch for leading and trailing blanks.

Only problem at the moment is that I cannot find where the filters are stored and cannot edit existing filters. Each change requires building a whole new filter.



Job definitions

  • -.*First Storage Group.*Mailbox Store-0.*
  • SYSTEM_LOG\application
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*First Storage Group.*Mailbox Store-0.*
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*First Storage Group.*Mailbox Store-0.*
  • Per Poll
  • Toggled
  • Generate
  • Send


  • -.*SG1 LSsTEMP01.*MailStore-1.*
  • SYSTEM_LOG\application
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*SG1 LSsTEMP01.*MailStore-1.*
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*SG1 LSsTEMP01.*MailStore-1.*
  • Per Poll
  • Toggled
  • Generate
  • Send


  • -.*Test SG-2.*Mailstore-2a.*
  • SYSTEM_LOG\application
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*Test SG-2.*Mailstore-2a.*
  • Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*Test SG-2.*Mailstore-2a.*
  • Per Poll
  • Toggled
  • Generate
  • Send


By Russell (a CA amateur )

Retrieved from "https://en.wikibooks.org/w/index.php?title=CA_Unicenter_NSM_Textbook/Issues_and_Workarounds&oldid=3227886"