I'm trying to figure out if there's a way to have a conditional alert reset action. The use case is as follows:
I have an email integration setup with my service management tool that allows me to automatically open and close incidents within the service management tool on a node when it goes down and comes back up. The alert action sends an email formatted with XML tags to open the incident, and the alert trigger reset action sends an email formatted with XML tags to close that incident. What I'd like to be able to do is only have an email sent on the trigger reset action when the node has been down more than x amount of time. My thought being that if it comes back up within our SLA timeframe, then it's fine to auto close the incident, but if it takes longer I want the network technician to have to document in the incident why we exceeded the SLA timeframe.
Does anyone know how I might go about accomplishing this without have to write logic in an external program to do it? Thanks in advance for everyone's thoughts.
Mike
