Setting Event Management Threshold

[Looper23]

I have a requirement where I need to not create an Alert for the same node if I get a Clear from it within 10 minutes. So for example I receive an Event for Node1 at 10:23:00 with Severity as Major. Then at 10:25:00, I receive another Event from Node1 with Severity as Clear. How do I set Threshold so it doesn't create an Alert but only creates it if the Event came in at 10:33:00 or after for the same Node.

[Rahul Priyadars]

10:23 - Event 1 (Major) --> Spin Alert A1

10:25 - Event 2 (Clear)--> Alert A1 will be Closed

So if your Monitoring Tool Send another Major event after 10:25 and before 10:33 - It will re-open the A1 and keep opening if another comes within next 10 minutes? Please confirm

And make a new one if nothing comes for A1 till 10:33 then spin a new Alert A2?

Please confirm the behavior .

You can set threshold with time and frequency which is OOTB in event rule.

You can achieve by setting re-open closed parameter to 10 Minutes in properties. So if anything happens within last 10 minutes it will re-open else it will create a new one.

Hope this helps.

Regards

RP

[Looper23]

So right now, all we getting is two Events for one alert. We get Major/Warning and then few seconds or minutes later we get a Clear. What that does is create an Incident and then closes it right away. In order to mitigate that, what we want to do is this; once you receive an Event, for CPU/Memory saturation, wait 10 minutes before creating an alert. If you don't get a Clear within 10 minutes, then go ahead, create the Alert. If you do get Clear within 10 minutes, then never create an Alert. 

Let me know if that makes sense. Thanks! 

[Raj_Esh]

Hi Looper,

Have you tried the Alert correlation rules? Looks as below:

Hope it helps.

Thanks,

Raj

[Looper23]

Not sure if this will help with the issue since we want to NOT create an Alerts for the Events that have the same messageID but we created within 10 minutes of each other. Is there any other place I can edit that setting?