Incident email generation - how it works
Hi,
I'd like to get some information about incident generation in dynaTrace (6.x).
Let's say, I have an incident rule for a business transaction with a warning upper treshhold set to 5 seconds and a severe upper set to 10 seconds (for purepath response time).
If i configure the incident rule to send email on incident starts AND incident ends, how many emails will i get if the incident is violated mutliple times in one evaluation timeframe?
So let's say, my evaluation time is 10 seconds. These are the incoming bTs' max response times for every seconds of the evaluation timeframe:
second No. - max resp time - expected outcome of the incident
_____________________________________
second #1 - 4 seconds
second #2 - 6 seconds - warning incident starts
second #3 - 8 seconds - warning continues
second #4 - 2 seconds - warning incident ends
second #5 - 3 seconds
second #6 - 7 seconds - warning incident starts
second #7 - 11 seconds - severe incident starts (will this take over the place of the warning incident?)
second #8 - 12 seconds - severe incident continues
second #9 - 4 seconds - now what? both incident ends? or just the severe one (because the warning ceased to exist when the severe came)
second #10- 3 seconds
Is this correct?
My main question is about the emails:
I need one email for every incident start, and one email for every incident end (i'll calculate something from every started-ended email pairs i get). Important note: i need to see the "started"/"ended" words in the subject of the emails.
How many emails am i going to receive with the above example?
My thinking: I'll get 4 emails: Incident started (#2), Incident ended (#4), incident started (#6), incident ended (#9). Is that correct?
Now, i have a problem: sometimes i don't get the emails with the subject "... incident ended" or "... incident started". Some of them have the subject like "Incidents, ..." and in the body of the email i see multiple incidents.
My guess is when an incident occures (so a violation occurs) while the incident is active (so it already occured and didn't ended yet), the dT will send a summary email, instead of the "... incident ended" ones.
Thank you for the help in advance!
Best regards,
Tamas
Hi Tamas,
If your evaluation time is 10 seconds then depending on you aggregation it will send the alerts.
for subject line you can use the extended email action plugin.
Best Regards,
Jaydatt
Hi Tamas,
Here is a forum thread that has details on how incidents work in dynatrace. Help needed in understanding dynatrace incidents
-Sreerag
