Automation rule JIRA Audit logs missing and ran the rule for wrong issues

[Karthikeyan]

We have an automation rule running in agile JIRA. The intention of this rule is to send mail notifications to Assignee every Wednesday for the issues that has crossed due date.

It is suppose to send mails to the issues that is returned through JQL. But instead it sends mail to not related items as well.

And also, For the last trigger on 30th of November 2022 Wednesday, mails are sent to wrong items and interestingly audit logs are not found.

Rule name: Wednesday - Mail sent to Assignee every Wed if issue has crossed due date

Project Key: APPSECVM

JQL: (project in (50453)) AND (project = "Application Security-Vulnerability Management" AND type = Bug AND duedate < now() AND status not in (Closed, Fixed, Resolved, Done, Archived, Canceled, Cancelled, Deferred) AND assignee is not EMPTY)

Screenshot 1 : Audit logs missing for 30th

Screenshot 2 : Sent mail label shows the right issues picked as part of the JQL, but mails are sent not only to this, but sent to other issues that are not passing the JQL condition.

[Tom Lister · Accepted solution]

HI @Karthikeyan 

Is it possible to see what you are configuring in your email clause. When you say sent to other issues, do you mean assignees of tickets that are not passed due date?

I think you could also achieve the same outcome by using a filter subscription scheduled for Wednesday  with JQL as 

(project = "Application Security-Vulnerability Management" 
AND type = Bug 
AND duedate < now() 
AND status not in (Closed, Fixed, Resolved, Done, Archived, Canceled, Cancelled, Deferred) 
AND assignee is currentUser())

is this the JQL you are using or that shown in the screenshot.

 (project in (50453)) AND 
(project = "Application Security-Vulnerability Management" 
AND type = Bug 
AND duedate < now() 
AND status not in (Closed, Fixed, Resolved, Done, Archived, Canceled, Cancelled, Deferred) 
AND assignee is not EMPTY)

This will return all item in 50543 plus the items select in the second clause

Unless you have a custom field called type should it have "issuetype = Bug"

Does "AND status not in (Closed, Fixed, Resolved, Done, Archived, Canceled, Cancelled, Deferred) " mean the same as "resolution is EMPTY"

[Karthikeyan]

This is my email clause.

When i say other issues, i mean that issues that are not part of the JQL outcome. For eg, APPSECVM-249 has crossed due date, but it is resolved. So it shouldn't be sent mail. I am not seeing this issue listed when i run the JQL but mails are sent.

This is my JQL and this is the same that is visible in screenshot

JQL: (project in (50453)) AND (project = "Application Security-Vulnerability Management" AND type = Bug AND duedate < now() AND status not in (Closed, Fixed, Resolved, Done, Archived, Canceled, Cancelled, Deferred) AND assignee is not EMPTY)

This JQL yields me the right result. But i am wondering why it is behaving differently while running in rules. For eg, only 7 items you see in the sent mail of screenshot2 is supposed to be sent, but it picked many other items which are not met by the JQL condition.

I agree on the part of Resolution is empty. I can use that and issuetype as well.

Also, i mentioned about the Audit logs missing that is something to be noted.

[Tom Lister]

Hi @Karthikeyan 

The portion of the JQL "(project in (50453)) AND" isn't showing in the screen shot which is why I was curious as to its use. If present it would certainly give the effect you are getting i.e. all issues in 50543 are being included.

re runs have you got only recently updated issues set on

This may limit the data available to run the automation.

[Karthikeyan]

The portion of the JQL "(project in (50453)) AND" is automatically included in JQL when i

click the issues found of JQL. But anyway 50453 is still nothing but the APPSECVM project, which is not a problem.

And I cannot set this flag "Only include issues that have changed since the last time this rule executed". Because, irrespective of whether the issue is updated or not, i need to send mail to the assignee. This flag will omit the issues that are not changed, but the requirement is to cover them as well.

[Tom Lister]

Hi @Karthikeyan 

I think the problem is that because the trigger config is set for a project you are getting a final JQL syntax that is returning all the issues in that project.

(project in (50453)) AND ...

will return everything in 50453 PLUS everything in the next bracket clause i.e. your original JQL.

I suggest removing the project setting from the trigger to allow only your specific JQL to operate. Removing the extra project check in your JQL also seems to work.

I had been looking this on my cloud site. I've just performed the same test on my server setup and I will get more issues than expected in the automation result when a project is set in the rule config and JQL.

[Karthikeyan]

I still do not understand, how come an AND condition pulls everything in 50453 and the result of JQL. 
I think OR condition does this activity, if i have put OR condition between those two, then it will return if any of those are true. 

But now i have optimised the JQL to this, 

JQL: issuetype = Bug AND duedate < now() AND resolution is EMPTY AND assignee is not EMPTY

the same 9 issues are found. And even i click the 9 issues found, it gives me this JQL.

(project in (50453)) AND (issuetype = Bug AND duedate < now() AND resolution is EMPTY AND assignee is not EMPTY)

I will run this rule for a week and see how it goes.

And also, i am just wondering how the audit logs disappearing happened. 

[Tom Lister]

Hi @Karthikeyan 

I would check that 

resolution is empty

and

status not in (Closed, Fixed, Resolved, Done, Archived, Canceled, Cancelled, Deferred) 

give the same results. You may have a workflow transition to one of those states that is not setting a value for resolution. Having many end points in a workflow can be more work to manage. 

Have done more testing on automation and I think was wrong about the effects of 

(project in (50453)) AND ...

Re Audit log, if you changed the config on Weds 30th to run every 7 days, I would not expect it to be triggered until the next wednesday. There is a Run Rule option button to trigger immediately.

If you continue to get extra emails, you could separate the concerns of rule details, schedule and JQL by removing the rule project setting and splitting schedule and JQL.

[Karthikeyan]

Thanks for all your suggestions @Tom Lister

Will try those against me and see how it goes.

[Karthikeyan]

@Tom Lister 

My sincere apologies on this matter. Looks like the real problem is from our company's backup strategy.

To elaborate, it looks like there is also a dev instance apart from the production instance where these queries are running. I heard about this very recently and we checked the dev instance of our project and it looks like false triggers are happening from the dev instance. 

When they took the backup of prod instance to dev, they copied all the automation rules over a particular day. I have made changes to prod automation rules later but those are not reflected in dev instance. Means that these backups frequency is the problem. They are not taking the backups often. Causing all these problems. 

I checked those Audit logs from dev instance and i can see all those false triggers. I have disabled those rules from dev and it stopped all the problems. 

My sincere apologies again for wasting your time. But this was a good listen for me. These backups play a major role in automation rules.

[Tom Lister]

LOL

We’ve all done it at some point 

could you mark this as answered