Notification on increased Count

[Dan Allenby]

Hi,

We are currently on the essentials plan for Ops Genie and i was wondering if there was any way we can be notified each time the count of an alarm is increased.   We had an issues this week where we had an alarm which we was notified about, the alarm was acknowledged and then it dropped in and out of alarm for a few hours (Count increased to 12) before the customer started noticing issues, to which we wasn't aware.   Ideally we would be notified upon each count increase.

[Nick H · Accepted solution]

Hi @Dan Allenby ,

It's not possible to notify on each increase in alert count. That's basically the key concept and idea behind alert deduplication to prevent alert fatigue.

Deduplication is dependent on the alias field of the alert - which can be edited on other plans like Standard and Enterprise - but not really on the Essentials plan. On the Standard and Enterprise plans you can control what data parses in the alias field, as well create an alert for each of these alerts that increase count if that's the use case.

You also could use Notification policies on the Standard and Enterprise plans to suppress / delay notification until the count of the alert reaches a certain threshold. 

That's probably not much help, but it's simply a lack of plan functionality.

[Dan Allenby]

@Nick H Thank you.  That was the answer i expected but just wanted to double check incase i was missing something obvious. 

[Dan Allenby]

Hi @Nick H

One more question if thats ok.  If an alarm generates and is acknowledged will it auto close if it goes out of alarm?  We have quite a few alarms that come in and then auto close without intervention, but when they are acknowledged they do not appear to auto-close when the actual alert itself is clear. 

Thanks,

Dan

[Nick H]

Hi @Dan Allenby ,

Alerts close if it's done manually by a user, through the integration, or through a notification policy if it's configured to auto-close alerts. They will remain open unless one of these three actions is taken on the alert.

"We have quite a few alarms that come in and then auto close without intervention" - most likely through the integration if it's not manually done by a user. 

"but when they are acknowledged they do not appear to auto-close when the actual alert itself is clear" - if you mean that the alert is cleared outside of Opsgenie, but the alert remains open in Opsgenie, then the integration might not be mapped to close the alert when it does get cleared. If an alert is ack'd, it's independent of it being closed. These are two different actions.  

I know both those above might contradict one another, but integrations can close alerts without any manual action being taken on the alert as long it's mapped to do so. And it seems like this is what might/might not be happening.

Under the Advanced tab of the integration, you can configure what requests create, close, ack, etc. the alert through the request received by Opsgenie. Like notification policies, this functionality is only available on the Standard and Enterprise plans.

If you were expecting an alert to close, but it remained open in Opsgenie, you should check the Logs under the Settings menu to see if Opsgenie received the request, if there were any errors, if the alert was deduplicated instead of closed, etc. You can use the search bar to query on the alerts, as well the timestamp. 

https://support.atlassian.com/opsgenie/docs/search-logs/