Specifying the Severity Attribute

Specifying Acknowledge for the severity (SEV) attribute in an alert event report acknowledges a previously raised alert. The alert event report identifies the alert to acknowledge by matching the values specified for the attributes CLASS, INSTANCE, ALERTID, ALERTQUAL, and APPL used to raise the alert.

Acknowledging Multiple Alerts

More than one alert can be acknowledged by an event report if you specify the wildcard value “all” for an identifying attribute; for example, if you specify “all” for the attribute INSTANCE.

Changes to the Alerts Window

When an alert is acknowledged, it remains in the memory of the Operations Sentinel Alert Server and is marked as acknowledged. Acknowledgment of the alert is forwarded to Operations Sentinel Console, where the alert is marked as acknowledged in the Alerts window containing it.

When an alert is acknowledged, a check mark appears for it in the “Seen” column of its Alerts window in all instances of Operations Sentinel Console. This removes the highlighting from the corresponding alerts icon if it is the last unseen alert.

With an Active Alert Policy

If the alert being acknowledged matches an action list defined in the currently active alert policy, Operations Sentinel server executes any actions in the action list that apply to acknowledging the alert. Any unexecuted actions associated with raising the alert are canceled. Unexecuted actions may be waiting for a busy service or for a delay to expire.