How to escalate when an alert has deduplicated more than X times.

Question

We have a number of alerts which take a long time to resolve, and during the time the alerts are open we receive a duplicate alert every 4 hours for the same issue which are deduplicated in OpsGenie.  In a case recently we had an alert at warning level that had reached its x100 deduplications so when the alert changed to critical it wasn't picked up.

How do I create an escalation to a management team to alert them that an alert has been deduplicated 80 times, as this implies that we have had a problem open for many days.

I have tried an escalation policy but I am limited to raising an escalation if the alert isn't fixed within 1440 minutes of opening.

Mark Hankins_knp6a6 · Answer

This isn't what they were asking for.

What they want is a way to ESCALATE when a deduplication count is reached on alerts (so if you hit 80 for example) then you know it's a "chatty" alarm and needs to be seen by the next level of management.

What you're suggesting will not send an alert UNTIL that count is reached, which is the opposite of what they want.

There was a feature request here for this - https://jira.atlassian.com/browse/OPSGENIE-471

Now OpsGenie is being migrated into JSM, how can we see which Feature Requests are being moved from OpsGenie to JSM please? Or which have been completed?

Seems like this is popular.

It would seem like adding more filter options (just a de-dupe count field) into escalations would be more sensible though?

Nick Haller · Answer

Hi @Neil Benton ,

A notification policy might be a better solution for your use case. These can delay / suppress notifications unless a certain deduplication count is reached:

We have a feature request for something similar - to modify the alert after a certain deduplication count is reached: https://jira.atlassian.com/browse/OPSGENIE-471

Feel free to watch, follow and vote for that if of interest. In the meantime, a notification policy might be the best alternative.