CA Unicenter NSM Textbook/Issues and Workarounds

I thought I would share this with everybody given the effort that went into getting this to work.

What I wanted to do was raise alerts for a specific Storage Group / Mailstore going down using caiLogA2, and reset the trigger when that specific Storage Group / Mailstore came back up.


 * Event Type:	Information
 * Event Source:	MSExchangeIS Mailbox Store
 * Event Category:	General
 * Event ID:	9539
 * Date:		16/07/2008
 * Time:		1:41:38 p.m.
 * User:		N/A
 * Computer:	NZWNLSSTEMP01
 * Description: The Microsoft Exchange Information Store database "test SG-1\Mailstore-1b" was stopped.


 * Event Type:	Information
 * Event Source:	MSExchangeIS Mailbox Store
 * Event Category:	General
 * Event ID:	9523
 * Date:		16/07/2008
 * Time:		1:42:35 p.m.
 * User:		N/A
 * Computer:	NZWNLSSTEMP01
 * Description: The Microsoft Exchange Database "test SG-1\Mailstore-1b" has been started.

The specific identifiers in this case are the Event IDs and the Store nametest SG-1\Mailstore-1b

After much trial and error I have determined that the "\" is a special character that cannot be tolerated. Also the filters are sensitive to case and leading and trailing blanks. So…

We use the following filter settings with .* being the wildcard marker replacing what we can do without. NOTE that it a dot and a star .*

Using Positive Pattern & Positive Toggle Pattern.


 * Rule name
 * SYSTEM_LOG\application
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*test SG-1.*Mailstore-1b.*
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*test SG-1.*Mailstore-1b.*
 * Per Poll
 * Toggled
 * Generate
 * Send

Now all I need to do is reproduce this for all the different Mailstores being very careful to match the spelling and character cases, and watch for leading and trailing blanks.

Only problem at the moment is that I cannot find where the filters are stored and cannot edit existing filters. Each change requires building a whole new filter.

Job definitions


 * -.*First Storage Group.*Mailbox Store-0.*
 * SYSTEM_LOG\application
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*First Storage Group.*Mailbox Store-0.*
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*First Storage Group.*Mailbox Store-0.*
 * Per Poll
 * Toggled
 * Generate
 * Send


 * -.*SG1 LSsTEMP01.*MailStore-1.*
 * SYSTEM_LOG\application
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*SG1 LSsTEMP01.*MailStore-1.*
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*SG1 LSsTEMP01.*MailStore-1.*
 * Per Poll
 * Toggled
 * Generate
 * Send


 * -.*Test SG-2.*Mailstore-2a.*
 * SYSTEM_LOG\application
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*Test SG-2.*Mailstore-2a.*
 * Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*Test SG-2.*Mailstore-2a.*
 * Per Poll
 * Toggled
 * Generate
 * Send

By Russell (a CA amateur )