Keep the Secondary alerts still open even after Primary alert closed

[SNExploreGuru]

Hi,

I do have requirement to keep the secondary alerts in OPEN state even after Primary alerts gets closed. Need to see if the secondary alert is also closed by the clear alert or not.

By default, one option available but it is specific to Rule-based group, but need this for all types of groups.

• Secondary alerts remain open after a primary alert is closed in rule-based groups when the evt_mgmt.rule_based_manual_closure property is set to yes. This property is accessible from the Event Management Properties page (Event Management > Settings > Properties).

Can you please suggest if I can achieve this in any form.

Thanks,

Guru

[Ryan Zulli]

Hi,

 The idea behind closing the secondaries when the primary is closed is due to the accuracy of the grouping.  If we grouped/correlated correctly then the secondaries are symptoms of the root cause (primary)... if thats not the case then perhaps the correlation was not accurate in the first place.

Have you checked your automated groupings to ensure they are accurate?

Thanks,

-Ryan

[Rahul Priyadars]

+1

Whole concept of Root Cause Alert and Secondary Alerts is to reduce the noise so OPS team can work on more accurate place which is Primary Alerts.

Use case needs to be accessed.

Regards

RP