Event Management: Secondary Alert belongs to two Virtual (Group) Alerts simultaneously — both Virtual Alerts cannot close (PRB2022546)<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue A secondary alert in em_alert is incorrectly associated with two different Virtual (Group) Alerts at the same time. Because each Virtual Alert still has at least one open secondary, neither Virtual Alert can transition to Closed — even after the user attempts to close one of the Group Alerts manually. The underlying cause is duplicate rows in the em_agg_group table referencing the same secondary alert sys_id but two different Virtual Alert sys_id values. This is most commonly observed when Tag-Based Alert Clustering is enabled and is tracked as PRB2022546. Symptoms The secondary alert appears under two different Group/Virtual Alerts in the Secondary Alerts related list.Both parent Virtual Alerts remain in Open state and do not auto-close even after the underlying events have cleared.Closing one of the Virtual Alerts does not propagate the closure to the secondary on the other side.Querying em_agg_group returns two rows where the alert field is the same sys_id but the parent field points to two different Virtual Alert sys_ids.Most commonly observed when Tag-Based Alert Clustering is enabled and multiple alerts arrive within the clustering wait window. Cause A race condition exists in the Tag-Based Alert Clustering engine. When multiple alerts belonging to the same logical cluster arrive within a narrow time window, the engine can produce more than one Virtual (Group) Alert for the same cluster definition before the aggregation reconciliation step completes. The reconciliation step then inserts duplicate rows into em_agg_group — one row associating the secondary alert with each Virtual Alert. Because em_agg_group is the source of truth for the parent/secondary relationship used by the auto-close logic, both Virtual Alerts continue to see at least one active secondary and neither can auto-close. Tracked as PRB2022546 — Tag based group is created with single Alerts where em_agg_group points at 2 Alerts. Resolution Confirm the duplicate by querying em_agg_group with filter alert=[sys_id of the secondary alert]. Two rows pointing to two different Virtual Alert sys_ids confirms the issue.Identify which Virtual Alert should remain as the legitimate parent — typically the one with the larger or more accurate set of secondaries, or the one created first.Delete the orphan em_agg_group row pointing to the Virtual Alert that should not own this secondary. Use the list view as an admin or a background script with appropriate change control.Re-evaluate the state of both Virtual Alerts. The orphaned Virtual Alert should now be eligible to auto-close. If it does not, set its state to Closed manually.Track PRB2022546 for the permanent code-level fix.Workaround: review the Tag Cluster definition wait window. A slightly longer wait window can reduce — but not fully eliminate — race-condition exposure until the PRB fix is available. Related References PRB2022546 — Tag based group is created with single Alerts where em_agg_group points at 2 AlertsSource Case: CS9177872 — Discrepancy between a Secondary Alert and its parent group alert