[Alert State Race Condition] The related incident is not reopened when a repeated event triggers an alert where the incident is already resolved. The alert is being reopened and quickly closed with the message "Closing alert because the related incident is already Resolved or Closed", even though the setting for the Event Management has been set to "Reopening alerts will Reopen Incident".
Sequence of events
1. Alert is closed, and the incident resolved.
2. Event created and the alert is reopened.
3. The job "Event Management - create/resolved incidents by alerts" (which running every 11 seconds) closes the alert as it sees that the incident is resolved.
4. The "after" business rule name "Reopen associated closed incident" opens the incident.
Steps to Reproduce
Be sure the following system properties are set:
"Resolving an incident closes the associated alerts" checkbox is "Yes"
sys_properties name "evt_mgmt.incident_closes_alert" ==> "true"
"Reopening alerts will" ==> "Reopen Incident"
sys_properties name "evt_mgmt.alert_reopens_incident" ==> "reopen"
Identify an alert in the Closed state with a related incident in the Resolved state.
For this alert, try to put in an event to trigger the alert to reopen.
Expected result: The alert should be reopened, and the associated incident should be reopened too.
Actual result: The alert will reopen but the alert will quickly become Closed. The associated Work Note displays "Closing alert because the related incident is already Resolved or Closed".
For Jakarta, import the attached sysauto_script_fdab0713eb1211004d7763fba206fefc.xml file.
Note: In Kingston, the script of the scheduled job has been moved to the EvtMgmtAlertActions Script Include.
If you cannot upgrade to Kingston, manually do the same change in the EvtMgmtAlertActions script include.
To see what changed, look for var inProgress ;var secondsBack; var gt; in the old and updated job.
Related Problem: PRB1260213