Intermittently, Summary Alert configured for "all" and based on multiple simple alerts is triggered when only one of the simple alerts is triggered and therefore uncalled for.

Document ID : KB000009616
Last Modified Date : 14/02/2018
 Show Technical Document Details
Introduction:

A Summary alert based on multiple simple alerts and set to "all" is triggered unnecessarily.
Background:

The Summary alert is set up to be based on multiple simple alerts and set to "all" (and not "any").  Each simple alert has a danger threshold set.  On the Summary alert, the number of "periods over threshold" and number of "observed" periods have both been set to 1.
Environment:
The issue was reproduced on 10.2, but it is applicable to other APM versions.
Instructions:

Steps to reproduce:

a.) Create a summary alert that is based on two or more simple alerts and set to "all".  For the danger and/or warning thresholds, the number of "periods over threshold" and number of "observed" periods have both been set to 1.

b.) On one of the simple alerts, produce data that would cross the danger or warning threshold.  However the warning/danger thresholds are not crossed on the other simple alerts.

c.) Intermittently, it is observed that not only that simple alert has been triggered, but the summary alert has also been triggered.

 

Solution:

It is possible that the number of "periods over threshold" and number of "observed" periods have been set to 1 and not all simple alerts have returned data to the summary alert yet, and thus creating intermittent issue erroneously triggering the summary alert.  Please increase these two values for a longer period observation/evaluation period.