LM Logs alerts and SDT
Summary: Matt Whitney, Matt Whitney, raises a concern about the behavior of Scheduled Down Time (SDT) in LM Logs alerts. They have discovered that setting SDT via email from a log-based alert applies to the entire log pipeline for that device rather than just the specific log condition that triggered the alert. This results in unintended suppression of other alerts within the same pipeline. Matt suggests that SDT should be applied only to the specific log condition, similar to how SDT functions for datasource alerts, improving precision and effectiveness.
We recently found out that when we set SDT via email from a log-based alert configured in LM Logs, the SDT does not behave as expected.
If we respond to an alert email to set SDT, it ends up getting applied to the entire log pipeline for that device. So if any other log-based alert triggers on that device from that pipeline, it will also be suppressed. That seems like a poor design choice.
My request is that the SDT be applied to the specific log condition, not every log condition in the pipeline. This would be consistent with how datasource SDT works, where if we set SDT via email it applies SDT only to the alerting instance, instead of every instance of that datasource.
Patrick Sites
·6 months agoMatt, I have attached your request to an existing initiative we will consider in 2H of the year.