ALEC question: Should an up event be a situation?

Problem: I got some outages and ALEC created a situation with a nodeUp event.

Expected outcome: Situations based on outage events. Not based on resolve events.

OpenNMS version: 25.1.2, ALEC 1.0.2

Other relevant data:
It’s a default ALEC setup. No customizations made.

This screenshot was taken at ~7:40. Just as reference for the other events below.

Is the question the nodeUp event from sw202 should resolve the situation, right?

Are you looking at Events and not Alarms? When the nodeUp event comes it, it should reduce into the Down alarm and there for clear the Down alarm without incrementing the counter. If you are seeing Up alarms then you’ve either configured Alarmd to not reduce Ups into Downs (old style behavior) or you’ve modified the reduction/clear keys of the corresponding Down and Up events.

Otherwise, there should never have been an Up alarm unless the Down alarm had already expired and been deleted.

If your are looking at events, they are purely informational and are not part of situations.

David

Somehow, too… Basically I was wondering that nodeUp can be a critical situation.

Are you looking at Events and not Alarms?

Just as reference for the timestamps and what happened on the node.

When the nodeUp event comes it, it should reduce into the Down alarm and there for clear the Down alarm without incrementing the counter.

Yes. That is the default behavior and it works like this in my setup.

If you are seeing Up alarms then you’ve either configured Alarmd to not reduce Ups into Downs (old style behavior)

Not I am aware of. What do you mean with old style behavior?

or you’ve modified the reduction/clear keys of the corresponding Down and Up events.

No modifications made.

If your are looking at events, they are purely informational and are not part of situations

Maybe I should have also a look into the Alarm history in ES. Didn’t want to set up an additional Kibana until now.