KBI 311769 Escalation Alert Always Fired Even After Event Was Resolved
Version
Argent Advanced Technology – All Versions
Date
Tuesday, 13 August 2019
Summary
Customer found one Relator always fire an Escalation Alert even the Event was shown as ‘Resolved’ in Argent Console
Customer’s Relator Alert Escalation Plan settings as below
Customer’s Relator Recheck Settings as below
Relator is scheduled to run daily and repeat every 8 minutes
Technical Background
Customer believed the settings were reasonable, but after investigation, the combinatorial logic problem was identified in Relator Run Interval, Relator Recheck Settings, and Alert Escalation Plan
When Re-check Rule Status was set as ‘Use Normal Relator Check Mechanism’, it means recheck mechanism will execute at an interval defined in Relator run interval
In case showed above, it is every 8 minutes
‘Condition Is Corrected Only After Rule Is Not Broken Consecutively’ was turned ON and set to 2 times
It means event can automatically be ‘Resolved’ at minimum 16 minutes after initial Alert was fired ( 2 x 8 minutes = 16 minutes )
Since Escalation Alert will be fired after 10 minutes if no response, with the above re-check logic, Escalation Alert will always be fired before Argent can automatically resolve the Event and stop Escalation Alert
Resolution
- Review Relator Run Interval, Relator Recheck Settings, and Alert Escalation Plan
Ensure Recheck Settings allow Event resolving before Alert Escalation Plan starts
- Argent will deliver intelligence validating logical error described above in future release