Event Management: Closing Incidents closes alerts

[Kiro Shihataa]

If an associate incidents gets put into resolved, the alert gets closed, I want to add to that logic, and if the incident gets canceled I want to also close the alert. 

In the documentation below:  it says that happens inside scheduled job "Event Management - create/resolved incidents by alerts" but that doesn't exist... it seems that the action happens on a slight 10 second delay so it appears to be a scheduled script and not a business rule. 

https://docs.servicenow.com/bundle/newyork-it-operations-management/page/product/event-management/co...

Where can I find where this piece of the flow takes place?

Thanks!

[Ashutosh Munot1 · Accepted solution]

Check this out:

EvtMgmtAlertActions.runAlertActions = function() {
gs.warn("EvtMgmtAlertActions.runAlertActions shouldn't run anymore, it was used only in legcay Alert Actions Rules job and was replaced with EvtMgmtAlertActions.runAlertActionsFromManagementJob in the new Alert Management job ");
};

Thanks,
Ashutosh

[Kiro Shihataa]

Thanks! Found the script include that does the change it's called by this scheduled job "Event Management - Evaluate Alert Management Rules" which calls this script include "EvtMgmtAlertManagementJob" which calls this script include "EvtMgmtAlertActions" and that handles that part of the flow.

[pratiksha5]

Hi Ashutosh, 

I have some incident with the following message. "

The related alert Alert0016396 is now unlinked from the previous incident INC0010900"
The alert management creating an incident but even on alert the incident is getting changed. What may be the reason behind this.