incident not getting closed when the Alert is created and closed before the Incident's creation - Known Error

incident not getting closed when the Alert is created and closed before the Incident's creation Description Incidents created from new Alerts may not get closed/resolved if the Alert is closed before the Incident has a chance to be opened.

This can happen when there are delays in processing the flow designer events of an alert, when there are a lot of events to process and the app nodes get busy, because Flow designer events are sent in batches, and the event will have to wait its turn and wont be picked up by another node.

Steps to Reproduce

Install Event management Create an event that would open an Alert, and another that would close it within a minute An alert gets created and closed within 1 minute An incident should be created upon the alert creation (using alert management rules) but it takes more than a minute to be created Expected behaviour:

The Incident should be closed when the Alert is.

Actual behaviour:

Within that time, the closing event for that same alert is received and the alert is closed before the incident is created.

This leads to problems in the incident's state. Any action that should have been triggered by the alert closure like setting the incident to resolved or closed will not take effect.

Workaround This problem is currently under review. You can contact ServiceNow Technical Support or subscribe to this Known Error article by clicking the Subscribe button at the top right of this form to be notified when more information will become available..

The workaround to resolve this issue is to create a new flow for creating the incident through the Alert Management Rule and add a logic that validates the Alert "status" before the creation of the Incident. The implementation logic should be as follows:

Once an alert is created, it invokes the subflow to create an Incident (configured in the alert management rule) In that subflow, retrieve an updated version of the em_alert glide record via Lookup Record subflow action. Perform a Lookup alert record on the updated alert before the creation of Incident. Here note that alert state is checked on the record received in step 2, not on the alertGr from the subflow input parameters. Don't use: input-> alertGR-> state Use: Alert Record -> state (from the lookup -> alert record, on the right side) Once we have the record, check If the alert is already closed. Either do not create an incident (add if condition) in this case or just create it with resolved state. In this way, the "problematic" incident will not be created and there will be less "noise" in the system. Related Problem: PRB1373919