Hello,
Event with the same message key keeps getting linked with the Closed Alert even the time Different between the Time of event field from event Record and the initial Event Time Field from Alert Record is more than 4hr (System Property:evt_mgmt.active_interval = 14400 sec).
Event record:
Time of Event: 2022-04-12 20:09:24
Alert Record:
Initial Event Time: 2022-04-06 13:33:07
But according to SN Doc If the time difference is greater than 4hr (System Property:evt_mgmt.active_interval = 14400 sec). An event with the same MessageKey should create a New Alert record rather than be linked to Closed Alert with the same MessageKey.
Doc Link: https://docs.servicenow.com/bundle/sandiego-it-operations-management/page/product/event-management/t...
When the new event is received, Event Management compares the active interval time to the elapsed time between the Time of event and Initial event time field values on the alert. Then, the system either updates the existing alert or creates a new alert (if the original alert is closed), as explained in the following table.
| Scenario |
Result |
| The new event occurs before the active interval elapses for the existing alert. |
The alert is updated with the event information. The event is identified as a recurrence of an existing issue and its severity is copied to the alert.
If the alert was closed before the active interval elapses, the alert is reopened and updated with the event information.
|
| The new event occurs after the active interval elapses for the existing alert. |
A new alert is created because the event is identified as a new issue. The event information is added to the new alert.
The system creates a new alert only when the original alert is closed. If the original alert is open, the new event updates the original alert, and does not perform the comparison between the Time of event and Initial event time.
|
Thanks,
Vivek
