XMA: how to resend XMA alerts when using IPALERT

XMA: how to resend XMA alerts when using IPALERT

Add Alert-Only movers to resend the messages with a FILTER that will not send the records created later than the end DateTime.
- The Start DateTime can be specified (e.g. "2022-05-09:00:00:00.000000") when the commands to start the added Alert-Only movers are entered.
- The End DateTime can be specified (e.g. AUDIT.RECORDLCT < "2022-05-10:12:30:00.000000") within a FILTER definition.

Note: The Alert-Only mover will issue alerts but will not insert records into the XMA database.

The steps to resend the messages are as below:
1. Add a FILTER to avoid sending records generated no later than a certain time, e.g. "2022-05-10 12:30" for all products.
2. Run the XMA_COMPILE_FILTERS macro 
3. At the XMA_MANAGER session, add an Alert-Only Mover for each product
for example; 
Select Option 2 (Mover)
Select Option 7 (Add) and enter the node name
Select Type and name, e.g. Option 4 for EMS mover
Enter 'N' as an answer to "Will this server collect data and issue ALERTS"
Enter 'Y' as an answer to "Is this an alert-only server - y or n"
Enter 'R' 

Repeat to add Alert-Only Mover for each product

4. Start the added Alert-Only movers from the desired time, i.e. "2022-05-09:00:00:00.000000"
5. Wait until all the messages have arrived on the SIEM
- check the Processed record dated from the STATUS information of the added Alert-Only movers via XMA_MANAGER macro
or
- check the messages on the SIEM
6. Stop the all added Alert-Only movers and delete them
7. Remove the added FILTER for resending the messages
8. Recompile the FILTERS file by running the XMA_COMPILE_FILTERS macro

Below is an example FILTER that sends the records no later than the end DateTime:
 FILTERDEFBEGIN $UDP-RESEND
 STATUS ACTIVE
 MOVER_BEGIN
   MOVER_SELECT_BEGIN
     PRODUCT = EMS
   MOVER_SELECT_END
   MOVER_SELECT_BEGIN
     PRODUCT = SAFEGUARD
   MOVER_SELECT_END
   MOVER_SELECT_BEGIN
     PRODUCT = XYGATEAC
   MOVER_SELECT_END
! add all other PRODUCTs 
!   MOVER_SELECT_BEGIN
!     PRODUCT = one each
!   MOVER_SELECT_END
!   MOVER_SELECT_BEGIN
! . . .
! . . .
 MOVER_END
 DATA_BEGIN
   DATA_SELECT_BEGIN
     FILTERTYPE STRINGFILTER
     AUDIT.RECORDLCT < "2022-05-10:12:30:00.000000"
   DATA_SELECT_END
 DATA_END
 ACTIONCOLL_BEGIN
! copy everything between ACTIONCOLL_BEGIN and ACTIONCOLL_END from the existing FILTER to send records over UDP and paste here
. . .
ACTIONCOLL_END
FILTERDEFEND