I'm working on a couple auto-operator rules and am having a hard time getting them to work the way I would expect. Basically, am finding some alerts stuck in a loop of being assigned and unassigned by the 2 profiles. I thought I had criteria set properly so this wouldn't happen, but obviously I am doing something wrong as it is not working as intended.
For the first profile ("clear assignment"), this is the matching criteria:
- Any severity (except clear)
- Message assigned to "create-ticket"
The profile runs on an interval of 5 minutes and the action is to run a script, within the script I check the difference between the current time and the time the alert was assigned, if it's been more than 60 seconds since it was assigned, clear the assignment:
local al = alarm.get() now = os.time() assignedAt = al.assigned_at diffSecs = now - assignedAt if diffSecs >= 60 then action.assign("", al.nimid) end
The second profile ("assign alert") has this matching criteria:
- Severity level = critical
- Message assigned to <none>
This profile runs on overdue age of 10s and the action is Assign to: create-ticket.
I have another process that listens to a queue for assigned messages and processes any alerts assigned to the create-ticket user. If the processing is successful, the alert is then assigned to a different user. The "clear assignment" profile is there to catch any alerts that are not successfully processed and unassign them so the alert is visible to the operators and they can process it manually.
The problem that I'm having is that the "clear assignment" profile seems to be resetting the overdue age as alerts get stuck in a loop of unassigned and assigned if they are not properly processed (on a related note, manually clearing the assignment in IM or USM does the same thing). Is there a way to clear the assignment without resetting the overdue age? Or is there a better way to set up the profiles to accomplish the same end result?