Ensemble - Suppressing multiple Alerts (e.g. NAKs, validation, etc) using Ens.Alert process

Question

Question

Brian Schoen · Jul 14, 2016

We are using the Ens.Alert alerting process to send alerts (via email) to our external service desk application (Service Now).

Is there a way to suppress multiple alerts for the same error (within a specified timeframe)? (Either Rule or BPL?) (i.e. a system starts sending bad data which fails validation or is NAKd by a downstream system -- causing every message to create an Alert.)

Otherwise, every message creates an Alert, which creates a ticket in Service Now.

Thanks,

Brian

Cache for UNIX (IBM AIX for System Power System-64) 2015.2.2 (Build 811U) Thu Mar 3 2016 13:03:08 EST [HealthShare Modules:Core:14.01.351 + Linkage Engine:14.0.351]

Discussion (5)1

Log in or sign up to continue

Brendan Batchelder · Jul 19, 2016

If you use Managed Alerts, there is a custom FunctionSet function IsRecentManagedAlert() which you can use to suppress repeated alerts. Here's an excerpt from the documentation:

The rule can check whether the alert is a repeat occurrence of a previous alert that is represented by a currently open managed alert. To do this, the rule uses the Ens.Alerting.Rule.FunctionSet.IsRecentManagedAlert() function. The IsRecentManagedAlert() function tests if there is a recent open managed alert that is from the same component and has the same text as the specified alert. You can optionally specify that the function adds a reoccurs action to the existing managed alert.

http://docs.intersystems.com/ens20161/csp/docbook/DocBook.UI.Page.cls?KE...

0 0

score 0 · Answer 1 · 2016-07-15T10:07:50-04:00

Maybe someone can offer a more clever solution, but you could create a custom function that you call from the condition field in your routing rule. You would pass it the error information and it would return a boolean for whether or not to send the alert.

Internally the function would use a custom table (or global) which stores the error information and the date/time that error was last alerted. When called it would check the last seen time against a threshold and either return a false to suppress the alert or send a true and then insert/update the error in the table.

score 0 · Answer 2 · 2016-07-19T10:45:19-04:00

Jeff Morgan · Jul 19, 2016

Comment entered in error.

0 0

score 0 · Answer 3 · 2016-07-21T13:34:25-04:00

Thanks for the suggestions. Here's what I have in place. Added two global variables to track last Alert Text & Date/Time sent out (updated as part of the DTL for alerts sent to outbound smtp). Created a custom function to call as part of the Ens.Alert rule (which takes in the current Alerts text & Date/Time).

Function:

ClassMethod CHNwCheckLastErrorAlert(
CurrentAlertText As %String,
CurrentAlertTime As %String) As %Boolean [ Final ]
{
Set SkipAlert = 0
Set AlertSeconds = 0

If CurrentAlertText = $GET(^LastErrorAlertText)

{
    Set AlertSeconds = $SYSTEM.SQL.DATEDIFF("s",$GET(^LastErrorAlertTime),CurrentAlertTime)

    If AlertSeconds < 300
        // If the Alert Text is the same as previous alert amd time stamp is less than 5 minutes, set to true (do not process alert)

         {
          Set SkipAlert = 1
         }
}

quit SkipAlert
}

score 0 · Answer 4 · 2016-08-07T12:57:59-04:00

Does anyone have a working example of how the IsRecentManagedAlert() function is coded in the routing rule?

I'm following the syntax, but can't get the function to return the ID of the existing managed alert, and therefore can't get the function to update the existing managed alert vs creating a new alert.