Incident Rules are not triggering for Alerts when created

[Ste404]

Hi there,

Just working through Opsgenie to get a better understanding of it and am stuck with Incident Rules.

I have alerts coming through for the Billing Service when I create an issue in JSM, works well.

I have a pretty wide Incident Rule in place to just use as a trigger to see it in action, but it won't fire.

As far as I can understand shouldn't this just create an incident based on any Alert coming in for the impacted service of Billing.  I expected it to create a P3 alert with the information in the relevant fields.

I have added other rules to look for specific Status or words also but nothing is firing.

Is there something specific I should be looking at to get this up and running.

I am the admin of the team that is bound to the Billing service and is added as responders to the issue also.

Thanks

[Nick Haller]

Hi @Ste404 ,

A few things to check with your current configuration. 

1 - Make sure that the JSM issues are sending to the same team that has this incident rule configured. Incidents rules are only reviewed when an alert is sent to the same team.

2 - If above is true, review if the alert(s) are associating with an existing incidents. 

I'm sure the idea with your configuration is to have each JSM issue create a new incident. But realistically what would happen is one JSM issue would create an incident. If the incident remains opens, and more issues are created, they'd be associated to the existing incident.

It's not possible with that filter to have each issue (or alert) create its own incident. We have a feature request for this you can follow, watch and vote for here: https://jira.atlassian.com/browse/OPSGENIE-73

An easy way of checking whether or not the issues / alerts are associating to an incident is in the Alerts tab, or under any existing incidents:

[Ste404]

My theory was that when alerts arrived and they would meet certain conditions (i.e. SMS Gateway as the service and P2 or above then an incident would be created based on the constructed incident rule.  I can't get the rule to fire with the Match All let alone anything specific in the matching conditions.

It is not a incident per every alert, I was testing from what I thought was the most wide spread angle possible.

My alerts come in from JSM with the correct team bound to the Service that was selected from Insight, just not sure why the incidents are not firing.

I'll dig deeper.

[Nick Haller]

Hi @Ste404 ,

You're theory is correct, and I'm not entirely sure why an incident is not being created when you have the incident rule's filter set to match all alerts.

Here is a test to show what should happen when an incident rule is set to match all alerts:

JSM issue creates Opsgenie alert:

Opsgenie alert is automated into an incident:

[Ste404]

hey I found something weird.  There is an incident created, I created one to make sure it wasn't permissions and such.

The alert rule is firing but it is associating the alerts with this incident and not creating new incidents.

Not quite how I need this to work?!

[Ste404]

aaahh the alerts were being picked up by the catch all and being associated with the incident that in place.  I got rid of everything, created two rules that had specific phrases in the Description condition and manually created two alerts and two incidents were created.

I created another alert that met one of the rules description conditions and no new incident was created but it was associated with the incident that the rule was relevant to.