Alert functionnality

[sigtb02]

How could i write an nested if statement that would enable my category alert to work off severity code (1 ,2 ,3 ,4 and 99) and two different calendars ????

[tommy]

In the bottom of this post I will show you our calculations for alerts.



I feel that I have to warn you: To get alerts to work like you want is extremely difficult. My collegue have been working on this for the past 6 months together with a certified SC consultant. And it still don't satishfy our needs 100%



The way that Peregrine has implemented alerting based on categories does not work with the way we work. Our alerting and escalations follow the customer not the category! I don't how it is in US.



On top of that You should add the fact that when using calendars the calculations are wrong!



Although this is all on SC3 I don't believe it has changed much in SC4.



You could probably use 2 calendars but expect it to be hard work to get it to work.



Now as promissed here is how our calculations look like (at present and not implemented in production yet):







if (md.stop.alerts in $file~=true) then ($p=val(priority.code in $file, 1);if (md.cust.alert.45.ok in $file=true and md.cust.alert.34.ok in $file=true and md.cust.alert.23.ok in $file=true and md.cust.alert.12.ok in $file=true) then (alert.time in $file=NULL;status in $file="Escalation Completed") else (if (md.cust.info.use in $file=true and not same(md.cust.alert.empty in $file, true) and $p>0) then (alert.time in $file=1 in md.alerts in $file) else (alert.time in $file=NULL;status in $file="updated");if (md.cust.alert.34.ok in $file=true and md.cust.alert.23.ok in $file=true and md.cust.alert.12.ok in $file=true) then (alert.time in $file=4 in md.alerts in $file;status in $file="updated/DEADLINE ALERT") else if (md.cust.alert.23.ok in $file=true and md.cust.alert.12.ok in $file=true) then (alert.time in $file=3 in md.alerts in $file;status in $file="updated/alert stage 3") else (if (md.cust.alert.12.ok in $file=true) then (alert.time in $file=2 in md.alerts in $file;status in $file="updated/alert stage 2"));if (md.cust.info.use in $file=true and alert.time in $file<tod() and not null(alert.time in $file)) then ($time=tod();if ($time<2 in md.alerts in $file) then (alert.time in $file=2 in md.alerts in $file;status in $file="alert stage 1") else if ($time<3 in md.alerts in $file) then (alert.time in $file=3 in md.alerts in $file;status in $file="alert stage 2") else if ($time<4 in md.alerts in $file) then (alert.time in $file=4 in md.alerts in $file;status in $file="alert stage 3") else (alert.time in $file=NULL;status in $file="DEADLINE ALERT"))))

[sigtb02]

You can have nested else statements. I thougt that you could have nest if then but not else ??

[tommy]

Yes indeed the expression listed does work. And very complicated it is yes. And only because Peregrine have implemented alerts the wrong way.



In our company we have several customers and they have different escalation procedures on priority level and not on category level.



A question to US members: Can you really use the alerting as Peregrine has implemented it? I would like your views on this, or is it just my company that is special.

[harn145]

It's not really that Peregrine have implemented alerting the wrong way, they use the "single support - single usergroup" principle.



If you want to use customer and/or accurate calendar based alerting, you should use the SLA module. This has all the customer based functionality in it, and requieres appr. 2 weeks to implement, including design and emmbedding into Problem Management (sc3) or Incident Management (sc4).



Greetz,

Jos

[tommy]

We looked briefly af SLA. Then we threw it away again.



Let me show an example of an escalation matrix for one customer:

priority   1     2     3      4      5

level 1   15m   30m   60m     4h     1d 

level 2   30m   60m   2h      8h     5d

level 3   60m   2h    4h      2d     -

level 4   4h    8h    1d      -      -

level 5   8h    1d    -       -      -

This is just an example.



The collumns represent the priority, the rows the management level, level 1 being a teamleader and level 5 being top-management. The numbers inside the matrix is the latest time to escalate to the appropriate level.



On top this we have a status matrix also which tell our agents when the customer need to be updated with information about the problem, this matrix is similar to the above and the times are off course different.



And we have this for each customer.



If this can be fit into SC4 standard functionality then I am sure my manager will be happy to hire the person that can do that (this is not to be considered a joboffer).

[sigtb02]

I do not see the reason where alerts should be influence by categories. Every help desk I worked on the condition of the alerts are always dependent of the severity of the incidents, sometime for critical path consideration the device id would influence this. But even so the influence would be reflected in the severity code of the problem and not reside in the category table. I do not understand their logic behind this, they tell me that there helpdesk logic rest on ITIL philosophy found in Pink Elephant. :grin:

[tommy]

Thats the point. I don't understand either why Peregrine has based the alerting on the categories, not even in a single company setup.



A software problem can be just as severe as a hardware problem, the escalation should be done based on priority / severity.

[sigtb02]

I still can't get alerts to function if the logique is respected the following category alert expression should alert all my tickets to deadline alert within 10 minutes :



alert stage 1



if (((severity.code in $file)#"1" or (severity.code in $file)#"2") and open.time in $file+val('00:00:30', 3)>=tod()) then (status in $file="alert stage 1");if ((severity.code in $file)#"3" and open.time in $file+val('00:01:00', 3)>=tod()) then (status in $file="alert stage 1");if ((severity.code in $file)#"4" and open.time in $file+val('00:02:00', 3)>=tod()) then (status in $file="alert stage 1");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



alert stage 2



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (status in $file="pas d'alert");if ((severity.code in $file)#"3" and open.time in $file+val('00:03:00', 3)>=tod()) then (status in $file="alert stage 2");if ((severity.code in $file)#"4" and open.time in $file+val('00:04:00', 3)>=tod()) then (status in $file="alert stage 2");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



alert stage 3



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (status in $file="pas d'alert");if ((severity.code in $file)#"3" and open.time in $file+val('00:05:00', 3)>=tod()) then (status in $file="alert stage 3");if ((severity.code in $file)#"4" and open.time in $file+val('00:06:00', 3)>=tod()) then (status in $file="alert stage 3");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



deadline alert



if ((severity.code in $file)#"1" and open.time in $file+val('00:07:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if ((severity.code in $file)#"2" and open.time in $file+val('00:08:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if ((severity.code in $file)#"3" and open.time in $file+val('00:09:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if ((severity.code in $file)#"4" and open.time in $file+val('00:10:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



But only 3 out of 98 are flagged properly. ???

[sigtb02]

oops here are my alerts without the smilleys :



alert stage 1



if (((severity.code in $file)#"1" or (severity.code in $file)#"2") and open.time in $file+val('00:00:30', 3)>=tod()) then (status in $file="alert stage 1");if ((severity.code in $file)#"3" and open.time in $file+val('00:01:00', 3)>=tod()) then (status in $file="alert stage 1");if ((severity.code in $file)#"4" and open.time in $file+val('00:02:00', 3)>=tod()) then (status in $file="alert stage 1");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



alert stage 2



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (status in $file="pas d'alert");if ((severity.code in $file)#"3" and open.time in $file+val('00:03:00', 3)>=tod()) then (status in $file="alert stage 2");if ((severity.code in $file)#"4" and open.time in $file+val('00:04:00', 3)>=tod()) then (status in $file="alert stage 2");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



alert stage 3



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (status in $file="pas d'alert");if ((severity.code in $file)#"3" and open.time in $file+val('00:05:00', 3)>=tod()) then (status in $file="alert stage 3");if ((severity.code in $file)#"4" and open.time in $file+val('00:06:00', 3)>=tod()) then (status in $file="alert stage 3");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")



deadline alert



if ((severity.code in $file)#"1" and open.time in $file+val('00:07:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if ((severity.code in $file)#"2" and open.time in $file+val('00:08:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if ((severity.code in $file)#"3" and open.time in $file+val('00:09:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if ((severity.code in $file)#"4" and open.time in $file+val('00:10:00', 3)>=tod()) then (status in $file="DEADLINE ALERT");if (severity.code in $file)#"99" then (status in $file="pas d'alert projet")

[rteggleston]

The alerts are in the category because category is what drives Incident management. If your alerts do not vary by category, you just write the same alerts for all categories.

[tommy]

The alerts are in the category because category is what drives Incident management. If your alerts do not vary by category, you just write the same alerts for all categories.

Even though it is in my opinion the wrong place to do it.

I guess that the main reason is that Peregrine is a US company and most US companies work this way. But that is not the case in Scandinavia or at least not in Denmark.

Escalation should be done on basis of customer and priority / severity and NOT based on category. I really can't see why escalation should be done on category.

And yes if the escalation is the same on all categories then the expressions should "just" be copied. But take a good look at the example I listed earlier, since then the expressions has grown and every time we change anything we have to change it in all categories. And the expressions is more complicated than they need to be if escalations had been done in a different way.