problem between icinga and opsgenie

[Aurelien Fovet]

Hi, I have a question between icinga and opsgenie.

I'm using binary icinga2opsgenie on my icinga integration.
When I have a CRITICAL state, an alert is generated and sent on opsgenie -> All is ok.
If CRITICAL become OK -> no problem, alert is closed on opsgenie.
But I have a problem:

I'm using states: OK, WARNING, CRITICAL, UNKNOWN.

Sometimes, a service which was OK become CRITICAL: an alert is created on opsgenie.
CRITICAL problem is solved by me, but in the same time, due to some probes, my service stay on WARNING state, not OK, then, alert on opsgenie stays opened (I have to close it manually).

My config for notification:

object User "opsgenie-contact" {
// object attributes
display_name = "OpsGenie Contact"
enable_notifications = 1
groups = ["opsgenie"]
period = "24x7"
// object vars
vars.notificationways = ["host-notif-opsgenie-contact", "service-notif-opsgenie-contact"]
vars.services_args += {
}
}

apply Notification "service-notif-opsgenie-contact" to Service {
command = "notify-service-by-opsgenie"
period = "24x7"
times.begin = 2m
states = [Critical, Unknown]

types = [Problem, Recovery, DowntimeRemoved, DowntimeEnd]
users = ["opsgenie-contact"]

if (service.vars["notification_period"]) {
period = service.vars["notification_period"]
}

if (service.vars["notification_interval"]) {
interval = service.vars["notification_interval"]
} else {
interval = 300
}

assign where host.address && !service.vars.notification_options_states && !service.vars.is_test && host.vars["notification_enabled"]
assign where host.address && service.vars.notification_options_states && host.vars["notification_enabled"]

}

What I want to do is: when alert change of state, this alert has to be closed.

Do you have some ideas?
Thanks for Help

A.

[Connor Eyles]

Hey @Aurelien Fovet 

My name is Connor from the Opsgenie support team here at Atlassian 😊

So if I understand your request correctly you are wanting to close an alert that was generated by Icinga whenever the state changes?

How the closing alerts work is based on the incoming data coming from Icinga and what filters are set for the close action. That being said when you set up a Icinga integration by default there are 2 close actions, 1 for Close Service Alert and 1 for Close Host Alert.

The filters are if the incoming payload matches both of these conditions then close the alert. 

Entity Type = Service
Event Type Equals Close



My suggestion for you would be to inspect the payload coming from Icinga (this can be done in Settings > Logs) and see what filter can be applied that matches the payload for when the state changes. Then update the filters for your close action so it will close the alert based on the incoming data that matches these conditions.

Let me know what you think!

Thanks,
Connor