Moogsoft Docs

Configure the CA UIM LAM

This document describes how to install and configure the CA UIM LAM to Moogsoft AIOps interface.

See CA UIM for UI configuration instructions.

The UIM LAM is a link access module that:

  • Monitors data being written to a queue in UIM.
  • Parses this data according to the LAM’s configuration file.
  • Constructs events that are passed to the MooMS bus
  • Publishes to the subject “Events”

You can configure the UIM LAM processing of alarms received from UIM by accessing the uim_lam.conf file, at the following path $MOOGSOFT_HOME/config .

Add UIM SDK to Moogsoft AIOps

SNAP/UIM installation has proprietary JAVA SDK included. It is used by multiple components in the SNAP or UIM. Add the SDK jar file to Moogsoft AIOps as follows:

  1. Locate the file on the server running the Unified Management Portal:
    On Linux can be found in the directory system/opt/nimsoft
    The file may be named differently depending on the version.

  2. Copy the file to the following location in Moogsoft AIOps:

You can use the the nimsoft-SDK.jar when you have the UIM license.

Fully Qualified Domain Name (FQDN) and hostname entry should be made in the host file (hosts).

Configure CA UIM

Create an attach queue on the target hub that will retrieve the "alarm" messages, with the following properties:

  • Active : checked
  • Name : moogsoft_alarm_queue
  • Type : Attach
  • Address : N/A
  • Subject : alarm
  • Bulk Size : N/A

Set the Subject to "alarm".  All other messages will be discarded by the CA UIM LAMbot  This reduces overhead on the target hub and CA UIM LAMbot.

Configure the CA UIM LAM

The alarms received from the UIM are processed according to the configurations in the uim_lam.conf file. The processed alarms are published to Moogsoft AIOps.

The configuration file contains a JSON object. At the first layer of the object, the LAM has a parameter called config , and the object that follows config has all the necessary information to control the LAM.

The following sections are available for configuration in the UIM LAM configuration file:


Agent and Process Log

HA Configuration


Constants and Conversions


The UIM LAM takes its input from a queue created in UIM. To establish a connection with UIM, you can configure the parameters here:


Field Type Description Example
name and class String Reserved fields: do not change. Default values are UIM Monitor and CUim Monitor.

Enter the hub IP/hostname/FQDN of the UIM application.

UIM Lam connects to the UIM hub (default port is 48002). Firewall, if any, should not block access to the port when UIM hub is running.


Enter the queue name from where you will subscribe the events. In case of multiple queue names, you can separate the queue with “,”.

queue: "event_management, data_queue"
bulksize Integer

The bulksize provides you the option to control the flow of received alerts. The entry in this field limits the LAM to process the number of events in one go. It can be either zero or greater than zero. The default bulksize is 100.

If a value of 100 is set, then at a time LAM will process 100 events. In case, when no value is given or 0 is entered in this field, then all the events received by LAM will get processed.


Config File
            name     : "UIM Monitor",           
            class    : "CUimMonitor",           
            hub      : "",           
            queue    : "queueName" 
            bulksize : 100        


The entry in the field bulksize should be an integer, therefore enter the value in this field without quotation marks.

Agent and Process Log

Agent and Process Log allow you to configure the following properties:

  • name : Identifies events the LAM sends to the Message Bus.
  • capture_log : Name and location of the LAM's capture log file. See Configure Logging for more information.
  • configuration_file : Name and location of the LAM's process log configuration file. See Configure Logging for more information.

HA configuration

Refer to the document LAMs and High Availability .

Data Parsing

Any received data needs to be broken up into tokens. Once the LAM knows the tokens, then it can start assembling an event.

In UIM LAM, the data is received in PDS (CA Proprietary format) and is extracted to MAP format.


You can directly map the alarm fields of UIM with Moogsoft fields displayed in the Moogsoft AIOps. Here input is restricted to JSON only, so the builtInMapper option will not be used for this LAM.

The mapping example is as follows:

            catchAll: "overflow",
                { name: "signature", rule:      "$origin::$robot" },
                { name: "source_id", rule:      "$source" },
                { name: "external_id", rule:    "$external_id" },
                { name: "manager", rule:        "UIM" },
                { name: "source", rule:         "$source" },
                { name: "class", rule:          "$subject" },
                { name: "agent", rule:          "$LamInstanceName" },
                { name: "agent_location", rule: "$origin" },
                { name: "type", rule:           "$values.robotname" },
                { name: "severity", rule:       "$pri", conversion: "stringToInt" },
                { name: "description", rule:    "$message" },
                { name: "agent_time", rule:     "$nimts", conversion: "timeConverter" }
            presend: "UimLam.js"

The above example specifies the mapping of the UIM alarm fields with the Moogsoft AIOps fields.


The signature field is used by the LAM to identify the correlated alarms. By default, it is set to a combination of the source and robot field. However, you can change it as per the requirements.

The following table and images show the mapped UIM LAM variables with the Moogsoft fields.

UIM alarm fields and Moogsoft AIOps alert fields mapping with examples

UIM Alarm Fields

Moogsoft AIOps Alert Fields





This parameter is for mapping only and is not displayed in Moogsoft AIOps UI.






Example: Dummy   field not present in UIM alarm, any other UIM field can be configured here.


Example: This is not displayed in Moogsoft AIOps UI.


Example:   WIN-FIJMK6PJEI8_hub


Example:  WIN-FIJMK6PJEI8_hub






Example: alarm


Example: alarm


Example: Dummy field not present in UIM alarm, any other UIM field can be configured here.


Example: This is not displayed in Moogsoft AIOps UI.


Example: WIN-FIJMK6PJEI8_hub


Example: WIN-FIJMK6PJEI8_hub




Example:   WIN-FIJMK6PJEI8


Example: 2


Example: Warning


Example: Average (2 samples) total CPU is 14.90 %


Example: Average (2 samples) total CPU is 14.90 %




Example:10:32:22   10/05/2016

Here the timeFormat "%D %T" is   used.

UIM CPU alarm fields :

UIM Disk alarm fields:

Constants and Conversions

Field Description Example
Severity and sevConverter has a conversion defined as sevConverter in the Conversions section, this looks up the value of severity defined in the severity section of constants and returns back the mapped integer corresponding to the severity
"CLEAR" : 0,
"WARNING" : 2,
"MINOR" : 3,
"MAJOR" : 4,
     lookup  : "severity",
     input   : "STRING",
     output  : "INTEGER"
stringToInt used in a conversion, which forces the system to turn a string token into an integer value
    input  : "STRING",
    output : "INTEGER"
timeConverter used in conversion which forces the system to convert time. If epoch time is to be used, then timeFormat mentioned in timeConverter should be commented. Otherwise, the user should provide the timeFormat
    timeFormat : "yyyy-MM-dd'T'HH:mm:ss.SSS",
    input      : "STRING",
    output     : "INTEGER"


Example Constants and Conversions
                "CLEAR"         : 0,
                "INDETERMINATE" : 1,
                "WARNING"       : 2,
                "MINOR"         : 3,
                "MAJOR"         : 4,
                "CRITICAL"      : 5
                lookup: "severity",
                input:  "STRING",
                output: "INTEGER"
                input:      "STRING",
                output:     "INTEGER"
                timeFormat: "yyyy-MM-dd'T'HH:mm:ss",
                input:      "STRING",
                output:     "INTEGER"

Custom Info

Events are displayed in Moogsoft AIOps, and the data in the fields of the event mapped in the mapping section are shown in the respective columns of Moogsoft AIOps columns. The incident fields which are not mapped in the mapping section are displayed in the Custom Info field for alert. An example of Custom Info is as follows:

Severity Reference

Moogsoft Severity Levels
            "CLEAR" 		: 0,
            "INDETERMINATE" : 1,
            "WARNING" 		: 2,
            "MINOR" 		: 3,
            "MAJOR" 		: 4,
            "CRITICAL" 		: 5,
Level Description
0 Clear
1 Indeterminate
2 Warning
3 Minor
4 Major
5 Critical

Service Operation Reference

Process Name Service Name
uim_lam uimlamd

Start the LAM Service:

service uimlamd start

Stop the LAM Service:

service uimlamd stop

Check the LAM Service status:

service uimlamd status

Command Line Reference

To see the available optional attributes of the uim_lam , run the following command:

uim_lam --help

The uim_lam is a command line executable, and has the following optional attributes:

Option Description


Points to a pathname to find the configuration file for the LAM. This is where the entire configuration for the LAM is specified.
--help Displays all the command line options.

Displays the component’s version number.


Specifies the level of debugging. By default, user gets everything. In common with all executables in MOOG, having it set at that level can result in a lot of output (many messages per event message processed).In all production implementations, it is recommended that log level is set to WARN. This ensures only warning, error and fatal messages are recorded.

Performance Information

Minimum requirement
Component Value
CPU 2 core
Operating System CentOS Linux release 6.7


Integration Version
Tool Version
1.0 - 1.4

Unified Infrastructure Manager 8.4