You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
I have an Incident which has been previously created from an Alert through the following Incident rule :
Then as a test I have a created manually a dummy Alert of P2 priority only with a different Alias than initial Alert which create the incident.
By doing so the created alert below, has been associated to the current incident BUT it has nothing to do with it as it is an other one, I was expected that a different incident would be created.
Why opsgenie did not create new Incident ?
What is the rule that Opsgenie apply in order to know if it should create a new incident or associate the Alert to existing one ?
Thanks for clarification
If an incident is created through an incident rule, and that incident remains open, then all other alerts that are created that match that same incident rule, will be associated with the same incident.
So essentially there can only be 1 open incident per incident rule at a time.
Hello @Samir ,
So in other words based on my configuration screen of Incident rules define in the current ticket, that means that any Alert where Priority = HIGH will be attached to that same Incident even if Alert as different Alias ?
Yes that's correct, it will be associated to the same incident until that incident is closed. Once the incident is closed, if a new alert matches that incident rule, a new incident will be created.
@Samir Thanks for clarifiction
One more thing.
If in the Incdent rule I have the criteria as below :
Alert title CONTAINS "Network Incident for instance"
If an Incident is already OPEN based rule above then Alert will be associated to that open incident.
Now if a new Alert occurs with PRIORITY=HIGH and ALert title is " Server Down"
Then no incident will be created correct ?
Depending on Incident rule settings I guess I could have more than 1 Incident OPEN at same time correct ?
Hello @Samir thanks for your reply.
In practice what could be by experience a sampple filter on incident rule which will associate alert in a more logical way and not only for priority ?
Should I base the rules on the title of the alert, the service, ?
thanks for sharing
It really depends on what sort of alerts indicate that you want an incident created. If there is something in the message of the alert that indicates an incident should be created, then filter on the message.
It comes down to which criteria dictates whether there should be an incident created or not, so it depends on your alerting setup and incident management practices.