Thanks wolfram, very informative post. This does seem to corelate to the observed behaviour, so I guess we can say that the product is behaving as intend (therefore not a defect).
That being said, when tracking circa 250 alerts per day over 10 orion instances having an alert shown as "active" just because it hasn't been closed down properly, and then having that alert re-trigger in Orion and end up down on the 3rd page cause the previous "active" alert had the same symptoms (i.e. node went down) can cause confusion.
The problem as I see it is (let's say) the alert is for node down - the cause of a node down can be due to a number of issues (power, network cable, locked up cpu etc. One node down event really shouldn't be grouped with the last node down event, as they may not be related.
Obviously the work around is to ack. and close the alert immediately, then track the incident in a ticket, however this means a manual check on the orion server to ensure the trigger condition is actually cleared.
Perhaps another state is needed "cleared" instead of just adding a note?
Hmm..... \off to ponder the options
Thanks again
Stuart
