Notifications

34 views

Description

Rules-based group not created by alert correlation rule.

  1. When an alert is created, BR "Calculate correlation rule" is executed. The BR calls AlertManager.calculateAlertCorrelation(grAlert)
  2. AlertManager calls AlertCorrelationHandler which:
    1. A. Checks if the alert matches one of the filters, for primary or secondary alert
    2. If the filter matches either primary or secondary, look for a match corresponding to the primary or secondary as configured in the alert correlation rule.
  3. On step A above a comparison is made based on the alert filter which is case sensitive.
  4. On step B above a GlideRecord query is made which is NOT case sensitive.

The above can lead to an inconsistent behavior depending on what alert is created first, Primary vs Secondary, a group may or not be created.

Steps to Reproduce

  1. Create alert rule with condition for primary alert for a CI type, cmdb_ci_win_server for example, and description CONTAINS "HeartBeat"(uppercase b)
  2. Condition for secondary alert for CI type only, cmdb_ci_db_mssql_databasefor example
  3. Create alert for secondary CI
  4. Create alert for primary CI and description with "Heartbeat" (lowercase b)
  5. Confirm no group created

Note: If alert for primary CI is created first in the scenario described above, the group is created.

Workaround

Ensure the alert correlation rule filter matches case as well. Add OR condition to take care of both case scenarios in the example where case cannot be guaranteed, i.e. "Heartbeat" OR "HeartBeat"


Related Problem: PRB1410894

Seen In

SR - ITOM - Discovery and Service Mapping - v1.0.35

Intended Fix Version

Quebec

Safe Harbor Statement

This "Intended Fix Version" information is meant to outline ServiceNow's general product direction and should not be relied upon in making a purchasing decision. The information provided here is for information purposes only and may not be incorporated into any contract. It is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. The development, release, and timing of any features or functionality described for our products remains at ServiceNow's sole discretion.

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2020-06-17 13:53:19
Published:2020-06-17