XMA: How does XMA determine the severity of events

• Related Articles

• XMA: Example of a SQL query to determine the number of unsent records in the SYSLOGQ table

  The sample query statements below can also be used as an input file, for example, SQLCI /in <in-file>/ on the XMA DB subvolume. The query to determine unsent records in the SYSLOGQ table. set list_count 0; set headings off; select cast (ALERTEDGMT as ...

• XMA: Warning messages received after executing XMA_SQLCOMPALL

  6006 and 6008 warning messages can be ignored. To determine the specific warning, check the contents of the file referenced in the "Please examing \<node>.<filename>" line. Where \<node> is the node where XMA_SQLCOMPILE was executed <filename> is the ...

• XMA: Events sent to SIEM are not delimited

  1. Check the IPALERT_MSGDELIMITER setting for the filter is correct. This value must match what is expected on the SIEM side and should be provided by the SIEM administrator 2. Check the ACTIONTYPE value is correct. a. If the SIEM is expecting TCP ...

• XMA: Can XMA movers send data off-box to a SIEM?

  Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...

• XMA: Msg#:217 Level:Critical Msg:ServerClass MQREADER (\node.$XMA) Maximum retries (24) reached on email alerts

  The setting for the max retries can be configured from XMA_MANAGER. The steps to change the configuration of the max retries are as follows: TACL> Volume <XMA installation SUBVOLUME> (ie. VOLUME $<VOL>.XYGATEMA) TACL> XMA INSTALL (To attach the ...