The Auto-Close Policies feature in APEX AIOps Incident Management lets you control how and when automated processes close incidents and alerts which were not otherwise closed.
Automatically closing alerts and incidents assists in:
Preventing outdated information from appearing in views
Your Incidents and Alerts pages should contain only the information requiring focus. Automatically closing alerts and incidents makes it possible to use filters in your view to easily hide old data so you can focus on operationally significant issues.
Maintaining data cleanliness
Periodically closing old items eliminates the possibility of irrelevant alerts and incidents impacting new ones.
Ensuring the accuracy of your Insights data
The Insights Executive Summary and Dashboard will not accurately reflect incident handling statistics if old data lingers unaddressed.
Alert and incident data remains available according to the APEX AIOps data retention policies, even when closed. Refer the FAQ page for data retention details.
While automatically closing old alerts and incidents has benefits, some environments require different settings for different items. Some reasons you may need a custom policy for a particular type of alert or incident include:
Some alerts and/or incidents always require human inspection and must never close via automation
Certain incidents may take longer to evaluate than others, meaning they need to remain active for a longer time than others
Some alerts or incidents need to close immediately after creation because they are known to be erroneous and should not interfere with viewing other data
Warning
Use caution when configuring automation policies. If too large a number of alerts and/or incidents remain open for long periods of time, performance will degrade, and it is possible the system may become non-responsive.
If you notice an accumulation of old alerts and incidents with a status other than Closed, review your Auto-Close policies to ensure that all alerts and incidents are eventually closed.
Auto-Close Policies includes two tabs: Alerts and Incidents. The following sections are available on both tabs and allow independent configuration of policies for alerts and incidents.
The Never Auto-Close setting allows you to define types of alerts or incidents that should never automatically close. This setting is ideal for alerts and incidents that always require additional evaluation or manipulation prior to closing. All alerts and incidents which match the scope of a Never Auto-Close policy are ignored by other Auto-Close policies.
Never Auto-Close is disabled by default. Toggle the switch to enable the option, and then create one or more Never Auto-Close policies as needed.
Auto-Close policies automatically close the alerts and incidents with data values matching specific filters.
The policies currently in effect appear on this page. Use the displayed Name and Description information to identify the intent of configured policies.
The Alerts and Incidents tabs each have a policy called Default Policy when an instance is first created. These policies can be modified or removed. The default policies close alerts and incidents according to the following rules:
Changes the alert status to Closed from any state after 72 hours.
Changes the alert status to Closed 30 minutes after it is set to Resolved.
Changes the incident status to Closed 60 minutes after it is set to Resolved, or when all alerts in that incident are closed (effectively resolving it).
Changes the incident status from any state to Closed after 7 days.