KBI 310693 Event Resolved Received Multiple Times For Emails Or SMS Or Pager Or Network Message

Version

Argent Advanced Technology all versions

Date

Monday, 30 Sep 2013

Summary

Customer may receive multiple Emails, or SMS messages, or Pager messages, or Network messages for the same resolved event

Technical Background

Argent Console has registry entry of

HKLM\SOFTWARE\ARGENT_CONSOLE\SERVER\SEND_CORRECT_NOTIFY_TO_ESCALATED_ONLY

This flag controls how to overwrite the email send-to addresses for resolved events

When the registry is set to 1 (TRUE), Argent Console Engine remembers the send-to addresses of fired Email Alerts

When the event is resolved and email notification is about to send, Argent Console Engine overwrites whatever send-to address in the notification, and replace it with the saved send-to addresses used in earlier Email Alerts for the same event

The purpose of this feature to make sure that only people who were alerted earlier are to be notified about the resolved event

If customer configures Relator similar to following example, he will get multiple event resolved emails, one for each Email Alert used in the Alert Macro




Click For Full Size

Assume the Rule is broken for Server A, and Alert Macro &AM_EMAIL_ALL is fired, one email goes to USER_1, and one email goes to USER_2. It is exactly what customer expects at this point. Because registry SEND_CORRECT_NOTIFY_TO_ESCALATED_ONLY is set to 1 (TRUE), Argent Console Engine remembers Email messages have been sent to USER_1 and USER_2 for this event

Assume a moment later, the condition is corrected, and the notification &AM_EMAIL_ALL should be sent. &AM_EMAIL_ALL contains two Email Alerts, EMAIL_USER_1 and EMAIL_USER_2. When Argent Console Engine sends EMAIL_USER_1, it will overwrite the send-to Email address to USER_1 and USER_2. As a result, EMAIL_USER_1 is sent to USER_1 and USER_2. The same for EMAIL_USER_2.

In the end, both USER_1 and USER_2 receive two event resolved Email messages. It is NOT what customer has expected

Note: The same analysis applies to SMS, Pager and Network Message Alerts as well

Resolution

There are two possible solutions:

  1. If customer wants to totally control where email messages of resolved event go, he can set registry SEND_CORRECT_NOTIFY_TO_ESCALATED_ONLY to 0 (FALSE)

  2. Define a new Email notification alert EMAIL_EVENT_RESOLVED and use it in place of &AM_EMAIL_ALL in the resolved event notification. Customer can use whatever send-to address in the definition, as it will be overwritten by Argent Console Engine anyway

Note: The same applies to SMS, Pager and Network Message Alerts as well