New alerts running againts severity and time

[sigtb02]

alert stage 1



if (((severity.code in $file)#"1" or (severity.code in $file)#"2") and open.time in $file+val('00:30:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('00:30:00', 3));if ((severity.code in $file)#"3" and open.time in $file+val('1 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('1 00:00:00', 3));if ((severity.code in $file)#"4" and open.time in $file+val('1 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('1 00:00:00', 3));if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



alert stage 2



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (header,alert.time in $file=NULL);if ((severity.code in $file)#"3" and open.time in $file+val('3 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('3 00:00:00', 3));if ((severity.code in $file)#"4" and open.time in $file+val('7 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('7 00:00:00', 3));if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



alert stage 3



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (header,alert.time in $file=NULL);if ((severity.code in $file)#"3" and open.time in $file+val('7 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('7 00:00:00', 3));if ((severity.code in $file)#"4" and open.time in $file+val('14 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('14 00:00:00', 3));if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



deadline alert



if ((severity.code in $file)#"1" and open.time in $file+val('02:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('02:00:00', 3));if ((severity.code in $file)#"2" and open.time in $file+val('05:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('05:00:00', 3));if ((severity.code in $file)#"3" and open.time in $file+val('14 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('14 00:00:00', 3));if ((severity.code in $file)#"4" and open.time in $file+val('30 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod()+val('30 00:00:00', 3));if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)

[sigtb02]

I just can't seem to understand alerts yet. Is there a way to trace the flagged values of the problem and alert agent. Besides sch, i tried this but nothing seems to get flagged there ???

[harn145]

Alerting through category uses a "forward schedule" principle, where on saving (add/update) of a ticket, the alert times are calculated.



The system calculates all alert stages and the deadline alert and created individual schedule records. These expire (are executed) on the calculated time.



Your alert stage 1 definitions should therefore look something like the following:



alert stage 1



if (severity.code in $file="1" or severity.code in $file="2") then (alert.time in $file=tod()+'00:30:00');if (severity.code in $file="3") then (alert.time in $file=tod()+'1 00:00:00');if (severity.code in $file="4") then (alert.time in $file=tod()+'1 00:00:00');if (severity.code in $file="99") then (header,alert.time in $file=NULL)



For deadline.alert you need to use a different field than alert.time, i.e. deadline.alert



When a schedule expires, it will update the ticket with the according status (field: status). This status change is an actual "database event" and can therefor be used for triggering macro's and/or Notifications (SC4) - type: IM Action Alert.



Hopes this clarifies it a bit.

Regards,

Jos

[sigtb02]

I appreciate the rapide response, thanks again. But to be more specific im trying to get alerts to work off severity and open.time. And i thing open.time comparisson is causing me the problem.



I tried three different comparaisson methodes but none seem to work :



open.time in $file+val("date", 3) against tod()

open.time in $file+"date" against tod()

open.time in $file+minutes against tod()



Here are my new and improved alerts, by no better :



alert stage 1



if (((severity.code in $file)#"1" or (severity.code in $file)#"2") and open.time in $file+val('00:30:00', 3)<=tod()) then (header,alert.time in $file=tod());if ((severity.code in $file)#"3" and open.time in $file+val('1 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod());if ((severity.code in $file)#"4" and open.time in $file+val('1 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod());if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



alert stage 2



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (header,alert.time in $file=NULL);if ((severity.code in $file)#"3" and open.time in $file+val('3 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod());if ((severity.code in $file)#"4" and open.time in $file+val('7 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod());if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



alert stage 3



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (header,alert.time in $file=NULL);if ((severity.code in $file)#"3" and open.time in $file+val('7 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod());if ((severity.code in $file)#"4" and open.time in $file+val('14 00:00:00', 3)<=tod()) then (header,alert.time in $file=tod());if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



deadline alert



if ((severity.code in $file)#"1" and open.time in $file+val('02:00:00', 3)<=tod()) then (deadline.alert in $file=tod());if ((severity.code in $file)#"2" and open.time in $file+val('05:00:00', 3)<=tod()) then (deadline.alert in $file=tod());if ((severity.code in $file)#"3" and open.time in $file+val('14 00:00:00', 3)<=tod()) then (deadline.alert in $file=tod());if ((severity.code in $file)#"4" and open.time in $file+val('30 00:00:00', 3)<=tod()) then (deadline.alert in $file=tod());if (severity.code in $file)#"99" then (deadline.alert in $file=NULL)

[harn145]

Malcom,



In order to have correct alerting, drop the and open.time in $file+val('00:30:00', 3)<=tod() part.



If alerting is to use the open.time, just redefine the alert definitions i gave earlier by replacing tod() with open.time in $file. This will make sure that on save an alert is scheduled that will expire on a "fixed" time (i.e. the open time plus 30mins) and thereby updating the ticket.



If you also want that an alert level only updates a tickets once, you best try to 'work with the system'. I have set up a similar alerting mechanisme, using severity.code and open.time, where all messages based on alerting identified a "new" alert level (not reched before) from an alert level reached earlier.



There is no way to work around the fact that a ticket will get the status "updated" after a save.



If this reply doens't meet your needs, please discribe the (functional) requirements in more detail (including status changes, notifications, etc.).

[sigtb02]

I don't understand you're reply, please give me an example of the expression that evaluates open.time and severity.



Thank you for you're response :smile:

[harn145]

alert stage 1



if ((severity.code in $file)#"1" or (severity.code in $file)#"2") then (header,alert.time in $file=open.time in $file+'00:30:00');if (severity.code in $file)#"3") then (header,alert.time in $file=open.time in $file+'1 00:00:00');if (severity.code in $file)#"4") then (header,alert.time in $file=open.time in $file+'1 00:00:00');if (severity.code in $file)#"99" then (header,alert.time in $file=NULL)



If you set up the alerting this way, alerts will be scheduled "in the past" and will therefore expire and update the ticket within the minute. So if it should be on alert level 3 - the ticket will "reached" this status within 3 mins of the update.



If you are using notifications on any of the alert stages, you will have to modify the FCroblem.alerts and notification entries for IM Alert Action a little to ensure alerts are only send on the first time a ticket reaches a specific alert level.



The easiest way to do this is to store the "current" alert level in the ticket, and set a $var if the new alert level is greater that the current, and then store the new alert level in the ticket again. This $var can be used in the condition for notifaction.

[sigtb02]

Is'ent it easy to set up the condition in the notification to make sur that alert.time or deadline.alert is not null.

[sigtb02]

I tried this but no result. When does the alert mecanisme flag the alert.time. I thouht it was whenever the condition came to true and the problem agent was functionnal.

[harn145]

The notification IM Action Alert is only triggered when it is updated as a bg-process, and the status is "an alert".



It will then evaluate the conditions in the notification definition to identify which message to generate etc.



In more detail, if you only want "new" alert levels (see earlier post), modify the problem.alerts formatctrl to save the alert level. Calculate if the "current" alert level is greater than the "saved" alert level, if so set $var to true, else to false.



In the notification, use "$var=true" and any other conditions you want to ensure (mail)messages are only generated on new alerts.



Details of fcroblem.alerts:

add/update = true

calculation 1:

if (nullsub(new.field, "")="" or status in $file>new.field in $file) then ($new.var=true) else ($new.var=false)

[sigtb02]

I dont have the problem.alerts formatctrl, even in a can system. Did you create this format control.

[harn145]

The system, on processing the alert, uses 1 of 2 alert formatcontrols:



[detailled] name=problem.[category].alerts or

[main] name=problem.alerts



It will only select the main if there is no detailled FC available.



There are defaults in the system for the category specific FC's, but the "main" is not in a canned system.



But you can add it without any additional concequence, other than that it will execute on every and any alert.



Regards,

Jos

[tommy]

Does this mean if you already have added alert specific calculations/validations/subroutines in the formatcontrol of problem.[category].update you can move that to problem.[category].alerts and they will still be carried out?



And is problem.[category].alerts executed before or after the normal formatcontrol?

[harn145]

The application flow is as follows:



<Schedule record for "category" alerts is executed>



1. Get category specific alert FC, if none, get generic alert FC.



2. Set status according to schedule



3. Do regular save action



4. During save, if no FC is provided, get form specific FC (e.g. problem.template.update FC). If FC is provided (action 1 generated a result) use that FC.



So:

If you have FC items specifically for the alert state changes, you can move them to the specific or generic FC.



The ".update" FC will then no longer be called upon.

[sigtb02]

All my alerts seem to work now even without the format control. I changed the expression to include Deadline alert group. Ever since then my deadline alertes seem to be running off of my expression !!! The problem alert agent seems to need this value but i don't see were it uses it ? Except of course that my deadline alert seems to be running properly :grin: