Hello all,
I have recently begun trying to configure Event Rules that include thresholds but I am stumbling across something that is stumping me. I am seeing situations where event management seems to get stuck in a loop of sorts. For some context, the events I am working with come from a Nagios XI instance.
In my example, I am trying to configure a threshold to only create alerts after a set number of memory events over a period of time. This portion of the rule works fine and I can see the events come in, match the rule, and create an alert if applicable. However, it seems Nagios does not always send an "OK" event once the condition has recovered. This should not pose a problem as I can simply set the Close Operator to 'Idle' and the period to something reasonable such as an hour. The property evt_mgmt.active_interval is set at 14400 seconds or 4 hours, which I would expect any new events to cause the existing alert to reopen in that timeframe. What I am seeing happen, is the existing events continue to get updated and the alert gets stuck in a loop of opening and closing.
Example:
Time of Event: 2022-03-01 17:37:25
Updated: 2022-03-02 14:58:44
I am at a loss as to why the event is being updated long after it is initially processed. Any ideas are appreciated!
