Reopening alerts using - evt_mgmt.alert_reopens_incident

[Henrik Jutterst]

I have some questions regarding the property "evt_mgmt.alert_reopens_incident". Because we had the idea to not do nothing and let the operator decide what do to with the Alert.

But to my surprise - when setting the value to "Do nothing" and new events arrive the old Alert remains closed. And this strikes me as very(!) strange. Basically it's just like deactivate the whole idea of working with Alerts, because the operator will never see that there are new events related to the Alert unless they look in the Events tab on the Alert.

Is there a property or something to reopen the alert and not create an incident?
This feels very strange to me.

[Rahul Priyadars]

Is there a property or something to reopen the alert and not create an incident?--> I doubt you can achieve this using any property.

Are you looking for this 

Event1->Alert1--> Inc1

Event2-->Alert1 ...leave INC in control of Operator

So one question is event1 and event2 has same message key?

Regards

RP

[Henrik Jutterst]

Hi and thanks for feedback.

Well, we want to have manual action from 24/4-team, but If they cant see if an alert is open without an INC is created it sounds a bit odd to me.

But If property i set to do nothing - Operators can't see that the state of the Alert is changing or even open.