I'm been building out some custom alerts for a client recently and I decided to build some custom reset conditions for some alerts. Why? Well, perhaps I am a glutton for punishment, but mostly because I wanted to ensure that when an application component (in this case) changed statuses away from the trigger condition (down or warn or critical, or whatever) that it moved into a valid status and not into Unknown or something like that.
As I was updating the alerts today I thought to myself : "Do I really understand how special reset conditions work?"
Here is the scenario.
I've built an alert that has defines the trigger scope of the alert as follows:
Application custom property Prod_Alert = TRUE
AND Application custom property Is_24x7 = TRUE
AND Application custom property Trigger_If_Warning = FALSE
I then defined the trigger conditions as:
Component = Down
Simple enough, right? The alert only checks the status of components where the application monitor custom properties Prod_Alert = True and Is_24x7? = True.
When I set the reset alert conditions I wanted to make sure that the component came back into a valid state but since I have some other alerts that use the same custom properties just with different values (specifically, Trigger_If_Warning = TRUE) I wanted to make sure that the alert reset condition only applied to these specific alerts.
I defined the reset scope the same as the trigger scope:
Application custom property Prod_Alert = TRUE
AND Application custom property Is_24x7 = TRUE
AND Application custom property Trigger_If_Warning = FALSE
I then defined the reset conditions as a whole bunch of valid reset states:
Component = Up
Component = Critical
Component = Warning
Component = Unmanaged
Makes perfect sense, right? If my alert triggers when the component is down, and only if the application monitor has those 3 custom properties set, then I only want to reset the alert if those some custom properties are set AND a valid component status is reached.
But what if someone changes a custom property?!?!
Remember, the alert triggers on a specific custom property and the reset is scoped to the SAME custom properties. If someone changes a custom property on an application monitor (say, Is_24x7 = FALSE) while an alert is triggered then the reset condition will never clear the alert because the trigger scope will never be true for that alert.
So, after the long explanation, here is my question...
Can the reset condition for an alert reset a triggered instance of another alert?
Basically, if Alert1 triggers an alert because Is_24x7 = TRUE and someone changes it to Is_24x7 = FALSE (meaning that the special reset condition is no longer scoped to catch this application monitor), can the triggered instance of that alert be reset by another alert with a reset condition that has a scope of Is_24x7 = FALSE even though that 2nd alert did not trigger the alert in the first place?
)
