Rules-based group not created by alert correlation rule.
- When an alert is created, BR "Calculate correlation rule" is executed. The BR calls AlertManager.calculateAlertCorrelation(grAlert)
- AlertManager calls AlertCorrelationHandler which:
- A. Checks if the alert matches one of the filters, for primary or secondary alert
- If the filter matches either primary or secondary, look for a match corresponding to the primary or secondary as configured in the alert correlation rule.
- On step A above a comparison is made based on the alert filter which is case sensitive.
- On step B above a GlideRecord query is made which is NOT case sensitive.
The above can lead to an inconsistent behavior depending on what alert is created first, Primary vs Secondary, a group may or not be created.
Steps to Reproduce
- Create alert rule with condition for primary alert for a CI type, cmdb_ci_win_server for example, and description CONTAINS "HeartBeat"(uppercase b)
- Condition for secondary alert for CI type only, cmdb_ci_db_mssql_databasefor example
- Create alert for secondary CI
- Create alert for primary CI and description with "Heartbeat" (lowercase b)
- Confirm no group created
Note: If alert for primary CI is created first in the scenario described above, the group is created.
Ensure the alert correlation rule filter matches case as well. Add OR condition to take care of both case scenarios in the example where case cannot be guaranteed, i.e. "Heartbeat" OR "HeartBeat"
Related Problem: PRB1410894