Cisco UCS MP: Fault Filter Configuration Pitfall

Issue
A customer of mine has imported the Cisco UCS MP in order to monitor multiple Cisco UCS Domains with SCOM. So many Alerts come in, among them Informational Alerts. However, Informational Alerts are unwanted so those must be filtered out. With other MPs this is easily done by disabling/modifying the Rules/Monitors which create these Informational Alerts.

However, the Cisco UCS MP uses another mechanism so disabling/modifying the related Rules/Monitors won’t fly here. Simply because the severity level isn’t set within those Rules/Monitors but on Cisco UCS Domain level and translated/parsed by the Cisco UCS Management Service, a component which is a part of the Cisco UCS MP.

Finally I thought I had found it. The earlier mentioned Cisco UCS Management Service has some good configuration items, among it the Fault Filter which is empty by default. So I thought creating a filter only stating the Alerts which get an Informational severity level in SCOM would filter them out:

HOWEVER, now all other Cisco UCS Alerts NOT having the severity level Informational disappeared and the Informational Alerts returned…

Cause
As it turns out (described many pages deeper in the Cisco UCS MP Guide, duh!…) when the Fault Filter has some one or more filters defined, it will ONLY pass on the Alerts matching those same filters, NOT STOPPING THEM!

Solution
So I redefined the Fault Filter where I only defined the Alerts which get a Warning or Critical severity level in SCOM:

And after applying it, the Information Cisco UCS Alerts disappeared and the Warnings and Criticals reappeared. Awesome!

Advice
The same component – Cisco UCS Management Service – also shows you what the default severity mappings CISCO UCS > SCOM are, see tab Severity Mapping:

It even allows you to remap UCS severity levels to other severity levels in SCOM.

DON’T FORGET TO RUN THIS COMPONENT WITH ELEVATED PERMISSIONS. OTHERWISE YOUR CISCO UCS DOMAINS WON’T BE LOADED SO YOU CAN’T MODIFY THE FAULT FILTERS.