Troubleshooting Alert Management Rules<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Use Case 1: Alert Management Rule Filter Condition having Maintenance Condition but Maintenance false on Alert Record. There is an alert management rule configured where the filter condition has only 2 parameters; 1. Source and 2. Maintenance. Below is the screenshot. On checking the em_alert table for closed alert and no Task(Incident) created, it is observed that Maintenance is false but still, the AM rule didn't trigger.In such cases, navigate to em_alert_history table and locate the same alert to see the value when the alert was opened. The closed alert will always show the maintenance as false but the alert history record can display the exact values when the alert was in the open state.In this case, we observed the alert history having records with Maintenance True thus the behavior "AM Rule Not triggered" is expected behavior. Use Case 2: Alert Management Rule not triggered or Delayed. In one of the use cases, it is observed that Part of the AM rules are triggered immediately after Alert creation but there were few AM rules that were not triggered. In this use case, we can see 4 out of 5 rules triggered around the same time but one rule triggered after 6 hours. Now the possible reasons for this could be: Alert Filter Condition not matched for 6 hours and an update to the alert caused the AM rule to pass. The Event Management - Evaluate Alert Rule not running. In this use case, as we can see there is only 1 event under the events tab which resulted in the creation of the alert, and no other event resulting to Alert update causing the filter condition to pass and trigger the AM rule. In this specific use case, it is observed that the Event Management - Evaluate Alert Management Rule job was running for 6 hours because of some customization. Use Case 3- Alert Filter Criteria Not matching. Sometimes, we overlook the AM rule conditions and assume that the attributes selected satisfies the condition. As checked in Use Case 1, the past value of alert can be seen in From Alert History table however if the attribute selected is a custom one then it becomes difficult to find the past value of the alert record.In the below screenshot the "Create Incident" is a custom attribute and the value of the field is set on the Alert record at the time of creation using a custom BR. In such cases, try recreating the use case by sending new events and analyze the code to narrow down the use case.