Notifications

359 views

Description

Application services shown in Event Management Dashboard have incorrect impact. Even though the alerts have been closed, the status will not be changed back to "normal" state. You can see that there is inconsistency between the alert state in em_alert and em_alert_history table.

Steps to Reproduce

  1. Set the alert BR "Set update time" as not active.
  2. Create before BR that sleep for you 90 seconds. (on em_alert table).
  3. Create an event, which will create an alert automatically.
  4. Check that the created alert have created time in the past and updated time in the past.
  5. Check that the alert does NOT copied to the alert history table.

Workaround

This problem has been fixed. If you are able to upgrade, review the Fixed In or Intended Fix Version fields to determine whether any versions have a planned or permanent fix.

If you are not able to upgrade yet, you can use the following workaround:

  1. Navigate to Event Management properties and change the value of "Number of events to process in bulk during each event processing job" from 500 to 1
  2. Or from the sys_properties table, change the property "evt_mgmt.max_objs_in_alert_query" from 500 to 1
  3. to fix current inconstancy that already created(dashboard shows closed alerts): run from "Scripts - Background" the attached script "emSupport-touchOpenAlertsHistory.txt" 




Related Problem: PRB1391728

Seen In

Paris
SR - IRM - Audit Management - New York 2019 Q3
SR - IRM - GRC Profiles - Madrid 2019 Q2
SR - IRM - GRC Workbench - New York 2019 Q3
SR - IRM - Policy and Compliance - Madrid 2019 Q2
SR - IRM - Risk Management - New York 2019 Q3
SR - IRM - SIG Assessment Legacy - Madrid 2019 Q1
SR - IRM - SIG Questionnaire - New York 2019 Q3
SR - IRM - Vendor Risk Management - Madrid 2019 Q1
SR - ITOM - CMDB CI Class Models - 201907
SR - ITOM - CMDB CI Class Models - 201909
SR - ITOM - Discovery and Service Mapping - 201908
SR - ITOM - Discovery and Service Mapping - v1.0.35
SR - Security - Integration Framework - Madrid 2019 Q2
SR - Security - Support Common - Madrid 2019 Q2
SR - Security - Support Orchestration - Madrid 2019 Q2
SR - SIR - Security Incident Response - Madrid 2019 Q2
SR - SIR - Security Incident Response PA Content - New York 2019 Q3
SR - SIR - Splunk Sighting Search Integration - Madrid 2019 Q1
SR - SIR - Store SecOps Setup Assistant - Madrid 2019 Q2
SR - SIR - Store Threat Core - Madrid 2019 Q2
SR - SIR - Store Trusted Security Circles Client - New York 2019 Q3
SR - SIR - Threat intelligence - New York 2019 Q3
SR - VR - Qualys - New York 2019 Q3
SR - VR - Vulnerability Response - New York 2019 Q3
SR - VR - Vulnerability Response PA Content - Madrid 2019 Q2

Fixed In

New York Patch 9
Orlando Patch 3
Paris

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2020-09-09 09:24:55
Published:2020-06-02
emSupport-touchOpenAlertsHistory.txt[View]