What is the difference between Alert state open or reopen?

[Henrik Jutterst]

Ok, I thought I knew this, but now I'm not so sure...

What is the difference between

• state: open
• state: reopen

I thought it was "new" alerts got state open as long as it was an active event/incident, and reopen whenever a closed alert got opened again.. But in the em_alert table I see alerts that have a very high "Overall Event Count", and that got me wondering.

Open:

Reopen:

And since I can't find any document of the difference of open/reopen I posted this question.

[Tony Chatfield1]

Hi, I would think that this could be possible,
an open alert would increment the overall event count  and a close alert could reopen and increment the overall event count

[Michael de Boer · Accepted solution]

I think you're correct.
Check the activities tab of both alerts.
I think the alert with te reopen state, was closed and reopened by a new event within a specific timeframe.
And the alert with the open state, never was closed but received a lot of (non ok) events with the same source/message key.

Regards,

Michael

[Henrik Jutterst]

Yes, you are correct. I also found this KB article explaining it a bit thorough here:
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0756521

A bit hidden if you ask me 

[Henrik Jutterst]

Link here: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0756521