Delay in Incident Creation

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

You see a consistent delay between the time an event occurs in the network and when an incident/ticket is created in downstream systems.

• The impact start time in SMARTS precedes the Notification Time by several minutes (e.g., 5–30 minutes).
• Downstream ticketing systems do not "see" the alert until the SMARTS Notification Time.
• Some transient alerts that clear quickly may never result in a ticket.

Environment

All supported releases of Smarts

Cause

• The delay is typically caused by Root Cause Analysis (RCA) correlation time combined with Notification List filter IsRoot is FALSE that suppresses notifications.

• When an event (e.g., NetworkConnection Down) first arrives in the SAM server, SMARTS initially sets the IsRoot property to FALSE while the underlying Domain Managers (SAM-01, SAM-02, etc.) analyze the topology to determine if the event is a root cause or a symptom. If the ASL script contains a rule such as if (xIsRoot == FALSE) { Result = FALSE; }, the alert is hidden from the Notification List during this correlation window. The alert only becomes visible to downstream systems once the correlation completes and IsRoot flips to TRUE

Resolution

• Inspect ASL Filter Logic: Review the active ASL script (typically in local/rules) for rules that filter based on the IsRoot attribute. Confirm if filtering non-root notifications is required for your business logic.

• Audit SAM Logs: Check the SAM-AGG or SAM-PRES logs for a flurry of SOURCE-NOTIFY updates. Calculate the time difference between the initial alert arrival and the final RCA completion.