Two Alerts Generated from same Spectrum MDRAlarmID

Products

• CA Service Operations Insight (SOI)

Issue/Introduction

We had two alerts with different AlertIDs in SOI generated on the same MDRAlarmID from Spectrum. One was ticketed while the other was marked by our command center as acknowledged but a duplicate. The ticketed one cleared due to our escalation policy to clear when the Incident is resolved but the duplicate remained out there and because of that it seems that new occurrences built up on that duplicate alert rather than creating new alerts since the alert still existed on that model in Spectrum. So critical alerts were missed. How can one Spectrum alarm generate two alerts in SOI?

Environment

Release : 4.2

Component : Service Operations Insight (SOI) Manager

Cause

The alert was published again after it was cleared

Resolution

When SOI manager gets an alert it updates the "LoggedTime" property with date and time it received,  when the alert is cleared from SOI the "ClearedTime" property of the alert  is updated with date and time it was cleared. Both of these properties can be found in dbo.Alerts table. In this case the "LoggedTime" of one of the alert shows later then the "ClearedTime", in other words, the alert was cleared then got republished again from the source.