Reopening of an Alert Group (Primary Alert) does not reopen related incident in domain separated instance - Known Error

Reopening of an Alert Group (Primary Alert) does not reopen related incident in domain separated instance Description In a domain separated instance: if you configure "Reopen alert will reopen Incident", reopening Primary Alert of an alert group will fail to reopen the related Incident. The conditions:

You have an alert management rule in child domain that overrides the one in parent domain. Reopening the alert has to be on the child/secondary alert (which is normally triggered by "clear" event anyway), not on the Primary alert. As the faulty logic only happened whenever "Service Analytics - Update virtual alert" job run. This is caused by "EvtMgmtAlertMgmtAlertReopenHandler" script include logic to evaluate if "alert is matching alert management rule" (alertMatchеsAlertManagementRules method) failed in domain separated instance.

Steps to Reproduce

Create a domain separated instance with multiple domains, for instance: parent domain A and child domain B. Make sure the configuration "Reopen alert will reopen Incident" is in place. Create alert management rule on domain A (let's name it AMR A) for a certain CI with "create incident" action. Create alert management rule on domain B (let's name it AMR B) that overrides alert management rule on domain A with the same action. Create 2 alerts on the same CI in domain B. Both alerts should be grouped together and new Primary Alert is created and Incident created on this Primary alert. Make sure there is alert execution records with AMR B created on the Primary Alert. Now close the Primary Alert which will close the Incident and all child alerts. Then reopen one of the child alert created on step 4. Wait until "Service Analytics - Update virtual alert" job run and it should reopen the Primary Alert. Observe that Incident on Primary Alert is not reopened. Workaround This problem is currently under review and targeted to be fixed in a future release. Subscribe to this Known Error article to receive notifications when more information will be available.

If you are not using manual action or background job to generate incident on the alert, you can bypass the logic to match the alert management rules as follow:

Go to EvtMgmtAlertMgmtAlertReopenHandler script include in your instance. Modify below lines inside handleReopen: function(current, alertNumber, manualIncidentByUserID, taskNumber, task) method from: else { var ruleMatched = this.alertMatchеsAlertManagementRules(current, amExecutionGR); if (ruleMatched) { this.reopen(current, taskNumber, task); } else { // no matched rule, and incident was created by Job, // the incident should not be reopened this.addWorkNoteAndClearTaskIfNeed(current, taskNumber); }}

to: else { this.reopen(current, taskNumber, task);} Related Problem: PRB1712416