Why isn't my Incident alert firing?
Hi, I am trying to set up an incident alert with the following conditions:
For all URIs containing "/atlas/SSO/SSOEndpoint.ashx", check the response header field, Location, for the string "Failed SSO".
Basically I want an email alert to be sent when there is the string "Failed SSO" in the Location response header of this URI - "/atlas/SSO/SSOEndpoint.ashx"
I've created this measure and the incident rule below, but I haven't gotten any emails even though I know the condition has been met. What am I doing wrong? Is my evaluation threshold not correct?
Thank you Rick! I really appreciate your thoroughness and quick response!
Thanks.
So I created a BT with this measure as a filter...
and I've configured my Incident to look like this...does this look right?
Yep! One problem: you shouldn't be splitting BTs on unique values like Account ID. This will cause too many splittings and your Business Transaction will put overhead on the Performance Warehouse until the BT stops working.
Hi,
Probably this measure should not be selectable from the Incident configuration as it doesn't actually generate any data on its own - it needs to be a part of a Business Transaction. Here's how you can get this working:
- Create a Business Transaction
- with your measure "Atlas-SSOEndpoint (Failed SSO Error)" you will do one of two things:
- If the number of unique messages (values for msg=*) is high or infinite, you should take the transformation regex out, set the evaluation to "occurrence" and add it to the Filter section of the Business Transaction. Otherwise:
- Add it in the splitting section.
- Edit your incident rule by removing the existing condition measure and adding the new one:
- Business Transactions -> (your BT) -> PurePath Response Time
- Change the aggregation to count and set the upper severe threshold to 1
Let me know how that works for you.
Rick B
