CA Unicenter NSM Textbook/Issues and Workarounds

I thought I would share this with everybody given the effort that went into getting this to work. What I wanted to do was raise alerts for a specific Storage Group / Mailstore going down using caiLogA2, and reset the trigger when that specific Storage Group / Mailstore came back up. Event Type: Information Event Source: MSExchangeIS Mailbox Store Event Category: General Event ID: 9539 Date: 16/07/2008 Time: 1:41:38 p.m. User: N/A Computer: NZWNLSSTEMP01 Description: The Microsoft Exchange Information Store database "test SG-1\Mailstore-1b" was stopped. Event Type: Information Event Source: MSExchangeIS Mailbox Store Event Category: General Event ID: 9523 Date: 16/07/2008 Time: 1:42:35 p.m. User: N/A Computer: NZWNLSSTEMP01 Description: The Microsoft Exchange Database "test SG-1\Mailstore-1b" has been started. The specific identifiers in this case are the Event IDs and the Store nametest SG-1\Mailstore-1b After much trial and error I have determined that the "\" is a special character that cannot be tolerated. Also the filters are sensitive to case and leading and trailing blanks. So… We use the following filter settings with .* being the wildcard marker replacing what we can do without. NOTE that it a dot and a star .* Using Positive Pattern & Positive Toggle Pattern. Rule name SYSTEM_LOG\application Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*test SG-1.*Mailstore-1b.* Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*test SG-1.*Mailstore-1b.* Per Poll Toggled Generate Send Now all I need to do is reproduce this for all the different Mailstores being very careful to match the spelling and character cases, and watch for leading and trailing blanks. Only problem at the moment is that I cannot find where the filters are stored and cannot edit existing filters. Each change requires building a whole new filter. Job definitions -.*First Storage Group.*Mailbox Store-0.* SYSTEM_LOG\application Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*First Storage Group.*Mailbox Store-0.* Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*First Storage Group.*Mailbox Store-0.* Per Poll Toggled Generate Send -.*SG1 LSsTEMP01.*MailStore-1.* SYSTEM_LOG\application Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*SG1 LSsTEMP01.*MailStore-1.* Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*SG1 LSsTEMP01.*MailStore-1.* Per Poll Toggled Generate Send -.*Test SG-2.*Mailstore-2a.* SYSTEM_LOG\application Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9539 User: .* Category: .* Description: .*Test SG-2.*Mailstore-2a.* Computer: .* Source: MSExchangeIS Mailbox Store Type: .* Event-ID: 9523 User: .* Category: .* Description: .*Test SG-2.*Mailstore-2a.* Per Poll Toggled Generate Send By Russell (a CA amateur )