Given an Escalation Policy with multiple actions:
We have an escalation policy with 3 actions:
We are seeing that the middle action to update the alert via REST fails almost all of the time - with the error that the alert cannot be found (because it is already closed). This empirically answers my second question but it doesn't make sense. We could delay the close of the alert with a different escalation policy. Or we could try updating the userAttribute with WSMAN in the hopes that it might allow updating the alert even if it is closed.
Has anyone discovered the intimate details of Escalation and Alert Action processing?
Updating my own post:
The REST update above fails - but not because the alert has closed. If we add a delay of 1 minute to this escalation policy, the REST update works - suggesting that maybe the alert isn't yet available via REST when we try to update it.
I would still welcome answers to the above question : - )
I'll let you know as soon as I have all the answer.
Here are the answer to your question in chronological order
1. YES, SOI launches the AlarmEscalationService threads in the order they appear in Escalation policy Action’s List.
2. NO, each AlarmEscalationService is triggered as a different thread sequentially.
Note: WS-MAN web services will be going away. We recommend using the Alert REST web services instead.
Let us know if you have any question or concern.