Hi Dojo,
we have a correlation which selects some elements and after that this filtering is active:
For every new alarm which is critical/major we will receive an email everything is fine. But we would like also to receive an email when the alarm is gone and back to normal. Is there something we overlook? When we test the rule we never see a “green” alarm. Tested also just with serverity equal to normal for example.
Hi Stefan,
Did you try to use the “execute on clear” option, you can find this at the bottom of your action section in the correlation rule.
Edit (1):
Can you also verify if you have the trigger on single events checkbox enabled?
Hi Stefan,
Can you please clarify what you mean by ‘this only affects real alarms’?
I mainly like to understand if you are feeding correlation alarms back into the correlation module, or if you are using only element alarms.
I’ve added a second screenshot to my initial answer, with the “trigger on single events” checkbox highlighted. Can you confirm this one is checked?
Hi Ive, many thanks for your help. When I enable trigger on single events it’s working. Execute on clear is not needed. I have tested both scenarios.
I’m happy to read you got it working!
Thanks for letting me know.
Hi Ive,
I have activated it now and have tested the rule, no impact on the test results.
But maybe this affects only to real alarms?