My issue includes how LM works w/ third part integrations. When an object is put in SDT then Alerts should be closed, and a closing event should be sent to the integration.
-
There are two different camps of thought on this:
-
1. The alert should stay open, and if/when the alert is resolved, then the alert is cleared. The issue with this is what if the system is put into SDT and then removed. There is no additional monitoring done to close the alert. Thus the alert is orphaned.
-
2. The alert is closed. If the alert is closed, a closing event is set to the integration. When the element is brought out of SDT, monitoring resumes and if there is still an issue an alert will be generated.
#2 is the more typical process. In that case if the alert was ACKed then there is no issue, because the original/ACKed alert was closed, and a New alert generated.
I also agree that ACKs should be cleared if the Alert changes to higher severity and ACKs should be removable.
Professor
