How to prevent parallel execution of Subflow

[RenukaA91595359]

Hi,

We have a subflow that is triggered by an alert management rule. Inside the subflow, we added a 5 minute wait condition as per the requirement, after which an incident is created.
If the alert is updated within those 5 minutes, the alert management rule triggers the subflow again, which results in a duplicate incident.

We want to prevent parallel execution of the particular subflow if an instance is already running. How can we achieve this?

Any guidance would be appreciated.

Thank you in advance!

Regards,

Renuka

[Fabian Kunzke]

Hey,

Alert management rules are not the place to "wait". And technically this will be harder to implement, as subflows don't have trigger options. So the only way to prevent this is to implement a check in the subflow, where you query the subflow-execution table to look for a subflow being executed with the same alert. This would still trigger the same flow, however you will be able to just skip the incident generation every time the subflow is already executing.

However, a much better approach, would be to supress the events in the first place. The alert itself should only be generated after those 5 minutes of wait time. Either that, or the alert is not important enough either way to generate an incident.

If, however, the alert becomes important after the 5 minutes (and this would mean that the alert is NOT closed automatically as an alternative) you are looking at an escalation workflow. This is not a native process to alert management, but could solve your issue - by increasing the priority of alerts whenever the 5 minutes are over (note: you may not be able to use alert management rules for that, as - again - a subflow does not have trigger conditions).

In short: I'd recommend to revisit the requirement.

1) Is it something which auto-resolves within the span of 5 minutes -> set a threshold in an event management rule and don't create an alert before the event hits this threshold

2) You need to escalate as no-one is reacting to this alert -> create a non-native escalation process within alert management

From my perspective it's either of these 2 options, but never an in-between. If no-one needs to react to the alert and they only want to react to it after 5 minutes, then the event management rule with a threshold will be enough - my guess is, that this is reflecting the requirement best.

Regards

Fabian