Virtual alert closed when secondary alerts severity are set to OK or Clear Issue Virtual alert closed when secondary alerts severity are set to OK(5) or Clear(0). This also leads to the secondary alerts being closed. CauseThere is a job called "Service Analytics — Update virtual alerts for aggregation groups" that updates the virtual alerts that were created to represent alert aggregation groups, with any changes to alerts belonging to that group. This job runs every minute.If alert aggregation is enabled it updates the virtual alerts accordingly. It runs a few checks on the virtual alerts. One of the checks is if this alert has any active/valid alerts. It checks for active/valid alerts by querying em_agg_group_alert_view. It queries for:Active: em_agg_group_alert_view.active = trueGroup ID: field "group" of the virtual alertSource: 1,4,7,8Severity: Not 0 (Clear), and not 5 (Info)If no active/valid alerts are returned, it will close the virtual alert which in turn closes all the secondary alerts.ResolutionThis is expected behavior and as per design. If this behavior is not desired, the following options would change the behavior: Keep the secondary alerts open when the virtual alert is closed (This is specific to rule based group): Set system property evt_mgmt.rule_based_manual_closure to true Do not close the virtual alert: Avoid setting the secondary alerts severity to OK, or Clear, unless they should be closed. If all secondary alerts severity are OK, or Clear, the virtual alert (which is the primary) will be closed and in turn this will close the secondary alertsCreate a new sys_choice value for severity which is not OK, or Clear, that could be used with your alerts