Troubleshoot Alert Correlation Rule


Description

  1. When an alert is created, BR "Calculate correlation rule" is executed. The BR calls AlertManager.calculateAlertCorrelation(grAlert)
  2. AlertManager calls AlertCorrelationHandler which:
    1. A. Checks if the alert matches one of the filters, for primary or secondary alert
    2. If the filter matches either primary, secondary, or advanced, look for a match corresponding to the primary or secondary as configured in the alert correlation rule.

Alert correlation can be calculated on demand, for troubleshooting purposes, by:

  1. Navigating to "System Definition > Scripts - Background"
  2. Runing script:
    var alertSI = '<sys_id_of_alert>';
    var alertManager = new SNC.AlertManager();
    var grAlert = new GlideRecord('em_alert');
    var grFound = grAlert.get(alertSI);
    if(grFound){
      gs.print("Calculate correlation rule for: " + grAlert.number);
      alertManager.calculateAlertCorrelation(grAlert);
    }

Instructions

  1. Recreate issue
  2. Confirm the alerts match the filters in the correlation rule
  3. Get the sys_id of the alert
  4. Set system property evt_mgmt.log_debug = true
  5. Run new calculation with steps in "Description" section of KB, replace in script <sys_id_of_alert> with actual sys_id
  6. Collect output from scripts - background
  7. Set system property evt_mgmt.log_debug = false
  8. Compare output with AlertCorrelationHandler to determine where the code is not behaving as expected

Additional Information

PRBs