nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Time based alert grouping?

Andreas Astrom

Hi there,

we're currently using PagerDuty but I've started to look over the fence on Opsgenie.

It looks feature rich but I can't find any resources on time based alert grouping.

It's a very useful feature in PagerDuty which will group alerts that come in during a predefined time-window into one incident assuming that alerts that are triggered within the same time-window most lightly originate from the same problem.

This works well for us since we've got quite a lot of monitoring going on in our Fibre Network and the time-based alert grouping will reduce the noise during bigger events.

Is there a way to achieve the same outcome with Opsgenie?

Thanks,

Andreas

Accepted answers

Nick Haller

Hi Andreas,

Opsgenie does have alert correlation that acts in a similar fashion:

https://docs.opsgenie.com/v1.0/docs/correlate-alerts-with-incident-1

Essentially if you have an ongoing service disruption (with your Fibre Network), alerts can be associated to an incident during the window its open - and group to the 'same problem' as you mentioned:

https://docs.opsgenie.com/v1.0/docs/correlate-alerts-with-incident-1#section-associating-alerts-with-an-existing-incident

Additionally - the incident updates, timeline, post-mortem and reports can be created/exported to incorporate all the data tied to the service disruption:

https://docs.opsgenie.com/v1.0/docs/incident-timeline

https://docs.opsgenie.com/v1.0/docs/postmortems

https://docs.opsgenie.com/v1.0/docs/post-incident-analysis-report

I know that's a lot of information and doc. sharing so please let us know if you have any additional follow up questions.

Best,

Nick

All comments

Nick Haller

Hi Andreas,

Opsgenie does have alert correlation that acts in a similar fashion:

https://docs.opsgenie.com/v1.0/docs/correlate-alerts-with-incident-1

Essentially if you have an ongoing service disruption (with your Fibre Network), alerts can be associated to an incident during the window its open - and group to the 'same problem' as you mentioned:

https://docs.opsgenie.com/v1.0/docs/correlate-alerts-with-incident-1#section-associating-alerts-with-an-existing-incident

Additionally - the incident updates, timeline, post-mortem and reports can be created/exported to incorporate all the data tied to the service disruption:

https://docs.opsgenie.com/v1.0/docs/incident-timeline

https://docs.opsgenie.com/v1.0/docs/postmortems

https://docs.opsgenie.com/v1.0/docs/post-incident-analysis-report

I know that's a lot of information and doc. sharing so please let us know if you have any additional follow up questions.

Best,

Nick

Andreas Astrom

Thanks for your reply Nick,

I did see that there's an alert correlation feature but I'm not sure that it works in the same way as the PagerDuty time based grouping feature.

There are no matching rules going on when alerts are grouped together in an incident, the only common denominator is that they appear in the same time window, hence most lightly originating from the same event.

Has anyone implemented this behavior in Opsgenie?

Nick Haller

I'm personally not familiar with PD's time-based grouping feature, but within an Opsgenie service's incident rule - multiple matching rules (and/or conditions) can be defined to associate alerts into one incident.

This does not have time-based functionality since it's all dependent on an ongoing incident, so the filter does need to be defined to match the alerts in order to associate them:

Andreas Astrom

Thank you that's helpful for my evaluation!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

opsgenie