Escalation Action Order and Behavior

[Legacy User]

Given an Escalation Policy with multiple actions:

1. Does SOI ALWAYS launch the actions in the order you put them in? I assume so, since you can move them up/down in the policy editor to change the order.
2. More importantly, does SOI ALWAYS complete an action fully before starting the next one, or are these just spawned as concurrent tasks?

 

We have an escalation policy with 3 actions:

• call an external program to say we've received an alert
• update a userAttribute with the current date/time. We do this with an external vbscript that calls the SOI REST interface to update the userAttribute. We cannot do this with an UpdateAlert action because there is no variable representing CURRENT date/time
• close the alert (it goes to Pending Clear for a few minutes)

 

We are seeing that the middle action to update the alert via REST fails almost all of the time - with the error that the alert cannot be found (because it is already closed).  This empirically answers my second question but it doesn't make sense. We could delay the close of the alert with a different escalation policy. Or we could try updating the userAttribute with WSMAN in the hopes that it might allow updating the alert even if it is closed.

 

Has anyone discovered the intimate details of Escalation and Alert Action processing?

[Legacy User]

Updating my own post:

 

The REST update above fails - but not because the alert has closed. If we add a delay of 1 minute to this escalation policy, the REST update works - suggesting that maybe the alert isn't yet available via REST when we try to update it.

 

I would still welcome answers to the above question : - )

[Shaheen Ahmed]

Hi Brian,

I'll let you know as soon as I have all the answer.

Thanks

Shaheen

[Shaheen Ahmed]

Hi Brian,

Here are the answer to your question in chronological order

1. YES, SOI launches the AlarmEscalationService threads in the order they appear in Escalation policy Action’s List.

2. NO, each AlarmEscalationService is triggered as a different thread sequentially.

Note: WS-MAN web services will be going away. We recommend using the Alert REST web services instead.

Let us know if you have any question or concern.

Thanks

Shaheen