KBI 311769 Escalation Alert Always Fired Even After Event Was Resolved


Argent Advanced Technology – All Versions


Tuesday, 13 August 2019


Customer found one Relator always fire an Escalation Alert even the Event was shown as ‘Resolved’ in Argent Console

Customer’s Relator Alert Escalation Plan settings as below

Customer’s Relator Recheck Settings as below

Relator is scheduled to run daily and repeat every 8 minutes

Technical Background

Customer believed the settings were reasonable, but after investigation, the combinatorial logic problem was identified in Relator Run Interval, Relator Recheck Settings, and Alert Escalation Plan

When Re-check Rule Status was set as ‘Use Normal Relator Check Mechanism’, it means recheck mechanism will execute at an interval defined in Relator run interval

In case showed above, it is every 8 minutes

‘Condition Is Corrected Only After Rule Is Not Broken Consecutively’ was turned ON and set to 2 times

It means event can automatically be ‘Resolved’ at minimum 16 minutes after initial Alert was fired ( 2 x 8 minutes = 16 minutes )

Since Escalation Alert will be fired after 10 minutes if no response, with the above re-check logic, Escalation Alert will always be fired before Argent can automatically resolve the Event and stop Escalation Alert


  • Review Relator Run Interval, Relator Recheck Settings, and Alert Escalation Plan

    Ensure Recheck Settings allow Event resolving before Alert Escalation Plan starts

  • Argent will deliver intelligence validating logical error described above in future release