I asked a similar question to TAC a few mounts ago and this is the answer I got.
1. The least possible effort is the global setting at the Enterprise Parameters, yet set one Severity Level and it is applicable for every alarm catalog. If you want to more control then Serviceability allows you to apply Severity Levels per Alarm Catalog.
2.a Do we have to set Enable Alarm under Remote Syslog on the services that we want to collect data from?
From the guide, you can see that it mentioned the “Enable Alarm for Local Syslog’s” in the table of Alarm Configuration Settings, even though the service may not support the settings.
Enable Alarm for Remote Syslog’s: The Syslog file serves as the alarm destination. Check this checkbox to enable the Syslog messages to be stored on a Syslog server and to specify the Syslog server name. If this destination is enabled and no server name is specified, Cisco Unified Serviceability does not send the Syslog messages.
The configured AMC primary and failover collectors use the remote Syslog settings. The remote Syslog settings used by the collectors are those configured on the respective individual nodes.
If the remote Syslog is only configured on AMC primary collector without configuring remote Syslog on AMC failover collector and failover occurs in AMC primary collector, then no remote Syslog will be generated.
You must configure exactly the same settings on all nodes, to send the remote Syslog alarms to the same remote Syslog server.
When a failover occurs in AMC controller or when the collector configuration changes to a different node, the remote Syslog settings on a backup or newly configured node are used.
To prevent too many alarms flooding the system, you can check the Exclude End Point Alarms checkbox. This ensures that the endpoint phone-related events get logged into a separate file.
Exclude End Point Alarms check box is displayed only for the Call Manager services and is not checked by default. You need to check the Apply to All Nodes also when you check this checkbox. The configuration options for endpoint alarms are listed in Alarm configuration settings.
2.b Do you have to set an IP for Server Name 1 on each service? is it enough to define a Syslog server under enterprise parameters?
Yes, you need to set an IP address for the Syslog server under each service alarm configuration, regardless you defined a Syslog server IP address under the enterprise parameters configuration or not.
