how can I make the message key unique so that a new alert/incident is always raised from a certain event

[annawilliams]

How can I make the message key unique so that a new alert/incident is always raised from a certain event?

Generally we use the default behavior so that related events are linked to a single Alert via the Message Key however we have a new requirement for a certain type of event that we need to configure to always raise a new alert/ incident, even if 2 seemingly identical events are received in close succession whilst the first is still being managed.   What is the easiest way of making sure the Message Key is always unique so that a new alert is raised, even though there is nothing obvious to distinguish the events.   Should I use a date/time stamp?

[Tony Branton]

Hi Anna,

Use an Event Rule to set the message key and include something like the date-time stamp (e.g. use the Inbound Action to set the time_of_event field).   Be sure to set the filter conditions so the Event Rule is correctly applied to only the events that need to be processed this way.

If a large number of these alerts are generated each day, you may want to consider the Service Analytics machine learning capability in Event Management to assist with grouping the alerts into correlated groups.   When the Dashboard or Alert Console has the Correlated Alerts slider switched on, grouped alerts are displayed in an expandable section reducing the number of alerts displayed in the console without actually removing any alerts (noise reduction).

[annawilliams]

Hi Tony

Thanks for your reply. Yes I have already concluded that using the date/time stamp is the best way to go. There is not a high number of events in this case so I think volumes will be manageable.

Regards

Anna Williams

Senior Infrastructure Manager

Royal Mail Group

Service Delivery

Room AT20 Rowland Hill House

Boythorpe Rd, Chesterfield S49 1HQ

(m) 07872 815223/ 01246 546822

(e) anna.williams@royalmail.com<mailto:anna.williams@royalmail.com>

Please note that I do not work on Fridays

Advance Leave Notification: 22 Nov (Training) 23 Nov (Leave)