Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Why all incoming alert are associated with the only existing incident

Dear all,

I have an Incident which has been previously created from an Alert through the following Incident rule :

chrome_HGwIJZ5vCL.png

Then as a test I have a created manually a dummy Alert of P2 priority only with a different Alias than initial Alert which create the incident.

By doing so the created alert below, has been associated to the current incident BUT it has nothing to do with it as it is an other one, I was expected that a different incident would be created.

chrome_fVh9WWdXD4.png

Why opsgenie did not create  new Incident ?

What is the rule that Opsgenie apply in order to know if it should create a new incident or associate the Alert to existing one ?

Thanks for clarification

regards

1 answer

0 votes
Samir Atlassian Team Jun 30, 2021

Hi @serge calderara 

 

If an incident is created through an incident rule, and that incident remains open, then all other alerts that are created that match that same incident rule, will be associated with the same incident.

 

So essentially there can only be 1 open incident per incident rule at a time.

 

Thanks,

Samir

Hello @Samir ,

So in other words based on my configuration screen of Incident rules define in the current ticket, that means that any Alert where Priority = HIGH will be attached to that same Incident even if Alert as different Alias ?

Regards

serge

Samir Atlassian Team Jun 30, 2021

Yes that's correct, it will be associated to the same incident until that incident is closed. Once the incident is closed, if a new alert matches that incident rule, a new incident will be created.

@Samir Thanks for clarifiction

One more thing. 

If in the Incdent rule I have the criteria as below :

Priority=HIGH
Alert title CONTAINS "Network Incident for instance"

If an Incident is already OPEN based rule above then Alert will be associated to that open incident.

Now if a new Alert occurs with PRIORITY=HIGH and ALert title is " Server Down"

Then no incident will be created correct ?

Depending on Incident rule settings I guess I could have more than 1 Incident OPEN at same time correct ?

regards

Samir Atlassian Team Jun 30, 2021

Yes that's correct, assuming that filter is set to "match all conditions below".

Hello @Samir thanks for your reply.

In practice what could be by experience a sampple filter on incident rule which will associate alert in a more logical way and not only for priority ?

Should I base the rules on the title of the alert, the service, ?

thanks for sharing

regards

It really depends on what sort of alerts indicate that you want an incident created. If there is something in the message of the alert that indicates an incident should be created, then filter on the message.

 

It comes down to which criteria dictates whether there should be an incident created or not, so it depends on your alerting setup and incident management practices.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Opsgenie

Leveraging Atlassian’s Opsgenie and AWS Cloudformation Registry to stay ahead of incidents

In the past, managing IT infrastructure was a hard job. It required a lot of manual effort and it was hard to keep track of all the necessary information (monitoring, scalability etc). Thankfully, as...

903 views 0 7
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you