Rules-based group not created by alert correlation rule because filter is case sensitive - Known Error

Rules-based group not created by alert correlation rule because filter is case sensitive Description Rules-based group not created by alert correlation rule.

When an alert is created, BR "Calculate correlation rule" is executed. The BR calls AlertManager.calculateAlertCorrelation(grAlert) AlertManager calls AlertCorrelationHandler which: A. Checks if the alert matches one of the filters, for primary or secondary alert If the filter matches either primary or secondary, look for a match corresponding to the primary or secondary as configured in the alert correlation rule. On step A above a comparison is made based on the alert filter which is case sensitive. On step B above a GlideRecord query is made which is NOT case sensitive. The above can lead to an inconsistent behavior depending on what alert is created first, Primary vs Secondary, a group may or not be created.

Steps to Reproduce

Create alert rule with condition for primary alert for a CI type, cmdb_ci_win_server for example, and description CONTAINS "HeartBeat"(uppercase b) Condition for secondary alert for CI type only, cmdb_ci_db_mssql_databasefor example Create alert for secondary CI Create alert for primary CI and description with "Heartbeat" (lowercase b) Confirm no group created Note: If alert for primary CI is created first in the scenario described above, the group is created.

Workaround This problem has been fixed. If you are able to upgrade, review the Fixed In or Intended Fix Version fields to determine whether any versions have a planned or permanent fix.

The fix doesn't change the default behaviour, but it does add a new system property so that this can be controlled. Add this system property to table sys_properties if you don' t want the values in the condition to be case sensitive: Name: sa_analytics.correlation_case_sensitive Type: True/False Value: false

As a workaround in previous versions, ensure the alert correlation rule filter matches case as well. Add an OR condition to take care of both case scenarios in the example where case cannot be guaranteed, i.e. "Heartbeat" OR "HeartBeat"