To disable alert from auto-closing

[rambhatia2017]

Hello

I am sending traps to ServiceNow.

When a fault trap is sent it created a new alert - as expected.

When I send a clear trap, it is attached to the same alert as expected. In addition, the alert is closed because it received a clear event.

I don't want the alert to auto-close, when a clear event is received.

Can someone, please explain how to disable alert from auto-closing ?

Thank you

Ram

[chanduchappa]

The property is "evt_mgmt.alert_auto_close_interval"

Configure automatic actions for alerts and incidents

When you set the property value to 0, auto closing will not happen. Please refer the attached link above.

[rambhatia2017]

Hi Chandu

Thank you for your reply.

Went through the link that you had provided.

Also, went through all the properties in Event Management --> Settings --> Properties

But unable to find a properly related to my issue.

evt_mgmt.alert_auto_close_interval is for automatically closing an open alert.

My requirement is different. Assume a clear event was received after a minute fault event was received.

This automatically closes the alert.

I don't want this to happen. I want the alert to be closed only when it is manually closed or if the incident is closed.

Please let me know, if there is any other property that I can set for this requirement.

Thank you

Ram

[Tony Branton]

Hi Ram,

Default behaviour in Event Management is to close an open Alert when the severity for a matching event is set to Clear (i.e. "0").   If you want the Alert to remain open, you could set the severity to Info (i.e. "5").   This is a simpler option than trying to create business rules or modify OOTB functionality.

[Ravi Prasad589]

Hi @Tony Branton ,

We have noticed an unusual issue in our system where the clear event isn't properly closing the existing alert, despite it being the standard behavior as you previously outlined. No changes to system properties or custom business rules on the alert table have been implemented. Could you please direct us to any official documentation that explains how the clear event is supposed to close the existing alert? This will assist us in diagnosing the root cause of this problem.

Best Regards,

Ravi Prasad