I created a user defined metric which simply consists of a sql statement looking for any unusable indexes other from schema sys or system and any value
greater than 1 creates a crictial event. That metric is loaded into a template which is applied to one database. In order to test incident rules I simply
either issue a alter index <index_name> unusable to create the event or alter index rebuild to stop the event. Another thing which needs to be pointed out
is that the Global Repeat Setting is not turned on for the environment - so no repeat messages should be set. I have been working on trying to setup a escalation
process when a alert isn't acknowledged - for testing that is a five minute time span. Then I created a incident rule set that is
made up of two rules.:
1. First Nofification:
"All Metric Alert events that match the following conditions: Not associated with incident Severity In (Critical;Warning)"
Action Step:
"Email to my <hotmail_account> address and Create Incident"
2. Escalate the Alert
"All Metric Alert events that match the following conditions: Associated with incident" and has the Action Summary "If event has been open for 5 minutes and satisfies the following condition
Associated incident is not acknowledged"
Action Step:
Email <work_email_address>
So I cause the index to become unusable in the database by running the alter index unusable command. What happens is that I get a alert notice sent to my hotmail account. That message shows a Incident Id and has the
correct Rule Name=Rule Testing,First Notification which is what I would expect. However, the second rule never occurs after 5 mins and longer. In fact all that continues to happen is I get the same email over and over
in my hotmail account until I run alter index rebuild.
I then read this support note 1368036.1 dealing with setup of incident rules - and I changed the second rule and selected Newly created incidents or updates to incidents
and used as selected events Rules that created in the inicidents First Notification which is the first rule and a Severity in Critical and Warning. The actions was if the incident has been open for 5 mins to send a email to my work address
address. However, the same result I get the alert message to my hotmail address - which is reaped over and over until I mark the index usable but nothing is sent to my work email address.
I simply can't figure out what is wrong - first I don't understand why the same email with the same incident number would be sent over to my hotmail account because like I stated the Global Repeat Setting in not turned on for
the environment. And I can figure out why the second rule isn't working and after 5 mins I get a email to my work address.
Any thoughts would really be helpful - I have attached a screen shot of the second rule/
Thanks,
Dennis