-
Suggestion
-
Resolution: Unresolved
-
None
User Problem
"Because monitoring systems can be quite 'chatty' by sending many events for the same problem and having to manage many alerts that were raised for the same or relevant source, de-duplication becomes crucial for many cases."
At the same time, some workflows require notifications initially, and also when a certain threshold is met. Or to modify an alert in some way when an alert deduplicates x-times.
Suggested Solutions
Having the ability for alert policies to filter on deduplication count, and then modify the alert when the threshold is met.
Example: if a P4 alert deduplicates >10, then modify the alert's priority to P1.
Having the ability to also modify an alert when a deduplication count is met enables customers to build better custom workflows.
Current Workarounds
Notification policies can delay / suppress notifications until a certain deduplication count is met.
But - will not notify initially when the alert is created. Notification policies cannot modify an alert either when an alert reaches a certain deduplication count.
- duplicates
-
- Gathering Interest
[OPSGENIE-471] Ability to have alert policies filter by deduplication count
Is this monitored? I've seen a few comments that have no responses.
Please provide an ETA
We need this feature as we need to escalate the alert based on its deduplication count. Please take this into consideration. Thanks..
We as well have use cases for both alert policies and incident rules where different occurrence thresholds require different routing/handling. Pretty much a must have feature! What has to happen to get this from "gathering interest" to "under consideration"?
What is the ETA of this request?
We have a similar requirement to create an incident automatically only when a certain alert is triggered 5-10 times
Notification policies also allow restricting based upon a number of occurrences within a time period. It would be useful to be able to have this same functionality in alert policies e.g. only assign a responder if an alert has multiple occurrences within a 30-minute period.
While it is nice that we have the ability to suppress notifications in the current workaround, we want to avoid generating alerts of higher priority than P5 unless they are requiring an action. With the suppress option we would have Priority alerts sitting in the dashboard that could confuse techs at tired hours like 3am be mistaken for real alerts.
This would be a great solution for those who use the information stream (P5) frequently.
+1