Can I set alerts to stop being triggered after the next step in the escalation path has been triggered?
Example:
Trigger=>Email L1
60 Min Passes=> email L2, stop Emailing L1
120 Min Passes=> email L3, Stop Emailing L2
Is there a mechanism for stopping alerts after a certain time frame, i.e send email repeatedly every 30 minutes for 4 hours then stop sending emails?
No. The only way the alert will stop is if the Trigger Condition is no longer true, or if the alert if acknowledged.
If your concern is duplicate emails, then simply ensure that the email addresses for each alert action are unique. There's no reason that email recipient "A" needs to be in all three alert actions. If they're in the first alert action then they'll continue to receive the email notification every 30min regardless.
Acknowledging the alert, either through the web console, or through the acknowledgement URL macro that can be used in Email and SMS alerts in the Advanced Alert Manager will suppress any further escalation.
Thanks for the reply. I think I may not have communicated my question clearly.
I have 3 actions that are set to take place when an event is registered, initial event email1, wait 30 min email2, wait 30 min email3. In the event that the alert is not acknowledged and it proceeds to the next step in the escalation process will both alerts be sent or just the one set to fire after the initial notification? i.e. email1 is sent but not ack'd after 30 min so email2 is sent; if this occurs will both email1 and email2 be sent or will only email2 be sent?
if both are sent, how would you recommend that I prevent the previous action from being executed?
In the event that the alert is not acknowledged and it proceeds to the next step in the escalation process will both alerts be sent or just the one set to fire after the initial notification? i.e. email1 is sent but not ack'd after 30 min so email2 is sent; if this occurs will both email1 and email2 be sent or will only email2 be sent?
If the trigger condition is still true, and the alert has not been acknowledged after 30min (as stated in your example) then one email will be sent to recipient 2. No additional emails are sent to email recipient 1 after the first, initial email was sent when the trigger condition was originally met UNLESS the option to "Execute this Action repeatedly while the Alert is Triggered" every "x" minutes is also set.
I will accept that answer, though it isn't quite what I was getting at. Here is another question that may be more to the original question I was trying to ask.
Reason for question: I have escalations that will include additional recipients depending on the position in the escalation path. EMAIL-1 to:A;B, EMAIL-2 to:A;B;C, EMAIL-3 to A;B;C;D etc...
at the moment i have to configure 3 separate emails that trigger at different times depending on how long the alert goes without being ack'd. In order to track who is getting what emails when I add additional recipients to each email going up the chain, this results in the people on email 1 getting multiple emails when email 2 is active and sent because email 1 is still active.
maybe the pic will help explain.
each email is sent every 30 min until alert is ack'd, which means the people on email 1 get 2 emails the first hour, 4 emails the second hour and so on I would prefer to send only 1 email every half hour to each party but still be able to limit the scope of each escalation level as per the SLA
