De-duplication for closed alerts

Question

Hi

We're using OpsGenie for our operations and I'd like to figure out a way on how to prevent de-duplicated alerts from re-appearing when the original is closed.

So suppose I have an alias "alias-123", which starts notifying the same alert for 5 times already (de-duplication) by the time someone acknowledges & closes it. If the alert still triggers after closing or acknowledging, I'd like for the alert to not pop-up again because our operations team willingly closed this alert & alias combo.

This would mean I have to take care of the proper alias naming to support all scenarios, but that's fine.

Is this possible?

Thanks in advance!

Serge

SergeMorel · Answer

I agree with your reasoning completely. However, it assumes that all alerts are actual issues.

In my case, not all alerts are issues that need to be fixed but rather are actual alerts saying "Hey, take note of this please". In my opinion, this use case validates having the kind of functionality described in this post.

Matthew Mcclure_35zru4 · Answer

Everyone has their reasons for wanting certain setups but I see a few potential problems with setting up an alert this way. The way we handle this internally is not completely closing an alert until the issue is resolved. That way future alerts get deduplicated.

Lets say you did get this setup in OpsGenie the way you want and close the alert right away and continue to work the issue. You would have to define some sort of timeout that a new alert should open in, maybe that is 4 hours as an example. So no future alert would be opened for 4 hours now. Lets say the team fixes it in an hour and think everything is good. Any new alert wouldn't be opened and the problem would go unrecognized for the remaining 3 hours. I hope that makes sense and I know it doesn't answer your question. Just thinking of potential pitfalls you could get into.

SergeMorel · Answer

That is indeed a nice solution! Though native support for this would be nice