Incident rule evaluation problem
I have this incident rule that should only be triggered after the condition exists for 30 minutes. For this I created a measure to produce the metric and configured the incident rule to evaluate the average value over a period of 30 minutes. Now it seems that the incident is triggered from the first minute the condition exists. What am I doing wrong?
Here is the measure:
This is the incident rule:
This rule is not triggered as espected after 30 minutes, but immediately:
The condition only existed for approx. 20 minutes, yet the incident was triggered.
I use the same measure for another incident rule, that needs to be fires immediately when the value goes over 5:
That one works fine.
Please advice.
Wim.
The problem in the first case is that you have "warning or severe" in the treshold dropdown specified. Becuase you have a Warning Threshold of 1 the Incident will trigger if the Average Value is >= 1 - so - this incident triggers everytime
In the second example you selected "severe" threshold - thats why it works
I would expect that the first incident is only triggered when the situation exists for at least 30 minutes (as I understand from the documentation, the situation is evaluated over the specifued time period, in this case 30 minutes). When the value is 1 for only 20 minutes, it should not trigger an incident (as the average would be < 1: 120 times1 and 60 times 0).
In the second example the time period is only 1 minute, so it will fire quickly.
Wim.
Thats correct - and that is how it should work. However - in your case because you have specified "warning and severe" and your severe threshold is set to 1 and you will always have at least 1 thread (correct?) it will kind of trigger immediately as well. So - please try to change that setting to "severe". If this still doesnt behave as you think it should be I would open a support ticket. Maybe there is an issue as it is supposed to work as you explained.
If I set it to severe, will it then be evaluated against 5 or against 1 ?
5 - because you have 5 in the upper severe threshold
If you specify "warning or severe" the condition is met if the actual value of the measure is >= the value specified in warning OR >= the value in severe. If you specify "severe" it will only trigger if the value is >= the value in severe
Andi
Andreas, still not convinced:
I need 2 alarms :
-1 that fires warning when one thread is hung for more than 30 minutes
-1 that fires severe when 5 threads are hung for more than 1 minute
For that reason I created the measure with the 2 threshholds (upper severe and upper warning) , and 2 incident rules (WebSphere Concurrent Longrunning Hung Threads Detected with an evaluation period of 30 minutes and WebSphere Concurrent Hung Threads Detected with an evaluation period of 1 minute)
From what you tell me I guess I need 2 measures then?
Wim
EMEA Community Member of the Month - November 2018
Announcing Dynatrace's EMEA Community Member of the Month for November 2018, Mathieu C.! Click here to read more! LATAM Community Member of the Month - November 2018
Announcing Dynatrace's LATAM Community Member of the Month for November 2018, Rene S.! Click here to read more! 
