Hello Folks,
I have a question around the alert action rules or Alert to Incident process. I have PRTG integrated into ServiceNOW EM. The events are coming in correctly and are using the correct message_key to open an Alert and then close it. I saw something unique happen yesterday where a PRTG event came in which created and alert and that was a critical so it matched a rule to create an Incident. This worked as designed. There was also a Clear event that came in at the same time the Incident was created. In Seconds, it was the same time. So the Alert closed correctly but the Incident did not go to resolved state as defined in the Event Management Properties.
I am assuming this is because the rule to create an incident might have executed at the same time the clear (OK) event was passed to the alert table. In fact, it almost looks like the OK alert came in and then the Incident was created.
Is there a way, in your environment you are seeing this type of issue happen. I have seen this in the past (rarely) but didn't focus much on it until now.
One thought I had was to add another condition in my alert action rule to make sure the state of the alert is not "closed" before it executes the create incident rule. Not sure if there is any impact to doing this.
Pls. do help me with your input /guidance. Thanks in advance.
Dan
