Did some sleuthing, and it looks like the <monitor> value is a string that matches the section headings in the web UI for each type of alarm config:
i.e. 'Local Syslogs', 'SDI Trace' and 'SDL Trace' for the Cisco CallManager service. You can see these values if you do a <getSyslogConfiguration>:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.cisco.com/AXL/API/11.5">
<soapenv:Header/>
<soapenv:Body>
<ns:getSyslogConfiguration>
<serverName>ds-ucm115-1</serverName>
<serviceGroup>CM Services</serviceGroup>
<service>Cisco CallManager</service>
</ns:getSyslogConfiguration>
</soapenv:Body>
</soapenv:Envelope>
-----------------
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<ns:getSyslogConfigurationResponse xmlns:ns="http://www.cisco.com/AXL/API/11.5">
<return>
<syslogConfiguration>
<serverName>ds-ucm115-1</serverName>
<serviceGroup>CM Services</serviceGroup>
<service>Cisco CallManager</service>
<alarmConfigs>
<AlarmConfig>
<AlarmLevelEvent>Error</AlarmLevelEvent>
<monitor>Local Syslog</monitor>
<Enable>t</Enable>
</AlarmConfig>
<AlarmConfig>
<AlarmLevelEvent>Error</AlarmLevelEvent>
<RemoteServerName1>192.168.0.1</RemoteServerName1>
<RemoteServerName2/>
<RemoteServerName3/>
<RemoteServerName4/>
<RemoteServerName5/>
<monitor>Remote Syslog</monitor>
<Enable>t</Enable>
</AlarmConfig>
<AlarmConfig>
<AlarmLevelEvent>Error</AlarmLevelEvent>
<monitor>SDI Trace</monitor>
<Enable>t</Enable>
</AlarmConfig>
<AlarmConfig>
<AlarmLevelEvent>Error</AlarmLevelEvent>
<monitor>SDL Trace</monitor>
<Enable>t</Enable>
</AlarmConfig>
</alarmConfigs>
<EndPointAlarm>false</EndPointAlarm>
</syslogConfiguration>
</return>
</ns:getSyslogConfigurationResponse>
</soapenv:Body>
</soapenv:Envelope>
The values for monitor seem to vary depending on which service is being configured, but the ultimate list appears to be based on the 'typemonitor' table in the database:
admin:run sql select * from typemonitor
enum name moniker display displayservername monitorstatus tkalarmseverity
==== ================ ============================= ======= ================= ============= ===============
0 Event Log ALARM_SEVERITY_EVENT_VIEWER t f t 3
5 Data Collector ALARM_SEVERITY_SNMP f f t 7
1 Sys Log ALARM_SEVERITY_SYSLOG t t f 3
2 AST ALARM_SEVERITY_SERVICEABILITY f f t 3
3 SDI ALARM_SEVERITY_SDI t f t 3
4 SDL ALARM_SEVERITY_SDL t f t 3
6 SNMP Traps ALARM_SEVERITY_SNMP_TRAP f f t 7
7 Alert Manager ALARM_SEVERITY_ALERT_MANAGER f f t 7
8 Alternate Syslog ALARM_SEVERITY_ALTERNATELOG t f t 7
Unfortunately the actual string values used in the <monitor> element appear to be based on the UI vs. the actual 'name' field in typemonitor, which would have made the needed values a bit more predictable.
