Hi Dojo,
we have adjusted our correlation which is not working 100% like we want.
What do we want to achieve:
- Email for each major/critical alarm
- Only when the alarm is longer than 1min
- Email for each normal alarm (but only if the alarm was longer than 1min)
How does our correlation script look like (element names are removed)?
For now it’s working correct for all critical/major alarms. But if the critical/major alarm is only for 10s visible you will only receive an email for normal state.
We don’t want to change the alarm template!
Is it maybe possible in the rule condition to access the timestamps?
We also thought about a duplicated correlation rule, problem you don’t know if the alarm was longer than 1min active.
Hi Stefan,
I think this can be achieved by letting your correlation rule create a new correlated alarm as explained here.
Then you could create a second correlation rule, that sends an email when that special correlated alarm gets cleared.
Kind regards,
Tom