Unable to resolve SumoLogic incidents from Opsgenie
Asked by aryanp:

Hi team,  

I have created an integration from SumoLogic to OpsGenie wherein when an incident is created in SumoLogic a corresponding alert is being triggered in OpsGenie.  

However, when an alert is closed from OpsGenie, the corresponding incident created in SumoLogic is not getting automatically resolved and we have to manually resolve the SumoLogic incident.  

Is this an expected behaviour?  

I was looking for something like the incident in SumoLogic should be automatically resolved when I close an alert form OpsGenie.  

Is this possible?  

Do let me know if any other details is required from my end.


Answers:
author: Nick H
body: Hi [@aryanp](/t5/user/viewprofilepage/user-id/5024871) ,

The Sumo Logic integration is a bit limited, and can only "send data" back to SM when an Opsgenie alert is closed:

![sumo1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214799i255616714FEDCE25/image-size/large?v=v2&px=999 "sumo1.jpg")

I'm not a SM expert, nor really know what data is actually being sent from Opsgenie - but if there is some sort of automation that can be configured on the SM side when this data is received, I'm sure it could close the SM incident.

But again, not sure SM has this type of functionality like Jira or JSM currently have with [automations](https://www.atlassian.com/software/jira/features/automation).

comments: author: aryanp
body: Hi [@Nick H](/t5/user/viewprofilepage/user-id/2540930)   

Thanks for the confirmation response.  

There's one more issue that I am currently facing with the SM and Opsgenie integration.  

I have basically set an alert to be generated in OpsGenie whenever an incident changes state in SM.  

For some time this integration works and the corresponding team users are notified of the alerts. But after sometime , the notification trigger seems to stop working.  
Basically, an incident creation in SM is not triggering a notification to the users.  

I have also configured an incident for the particular team.  

I can see this in the Opsgenie alert activity log,  

![Screenshot 2022-09-07 at 10.31.38 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/214801i7ED786C6B82B1FB7/image-size/large?v=v2&px=999 "Screenshot 2022-09-07 at 10.31.38 PM.png")  

The notifications were working fine for sometime and then it stopped working.  
No config changes were made.  

Also, earlier when everything was working as expected , for each SM incident, i could see two alerts being created in Opsgenie.![Screenshot 2022-09-07 at 10.35.04 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/214802i50756C28AAA98C30/image-size/large?v=v2&px=999 "Screenshot 2022-09-07 at 10.35.04 PM.png")  

But now I am able to see only one alert.  
Only the associated alert (**A** ) .   

Can you assist here?


author: Nick H
body: Hi [@aryanp](/t5/user/viewprofilepage/user-id/5024871) ,

It appears that the team receiving these alerts also has an [incident rule](https://support.atlassian.com/opsgenie/docs/automatically-create-an-incident-via-incident-rules/) configured to automate the SM alert into an incident.

When an alert is automated into an incident through an incident rule, the initial alert becomes an associated (A) alert - which in turn triggers a responder (R) alert (or multiple alerts if the service tied to the incident rule has multiple responders tied to it).

Any alert that is created after the incident is raised and matches the incident rules will also be associated. Important to note that only the responder alert(s) will notify users, while the associated alerts simply add to the incident without notifying:<https://support.atlassian.com/opsgenie/docs/associate-an-alert-with-an-incident/#Associated--amp--Responder-Alert-Behavior>

Here's an example of an incident rule I have for my Community Team:

![inc1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214815iFA917D0E786D9235/image-size/large?v=v2&px=999 "inc1.jpg")

Incident rule is tied to this Service, which adds other responders to the incident:![inc2.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214816i30BD9CCCEAF8913C/image-size/large?v=v2&px=999 "inc2.jpg")

Alert created \>\> matched incident rule \>\> triggered associated (A) and responder (R) alerts:

![inc3.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214823iDAB9A709EDFBB2CC/image-size/large?v=v2&px=999 "inc3.jpg")![inc4.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214819i1DEA53E15F1FDAB8/image-size/large?v=v2&px=999 "inc4.jpg")![inc5.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214817iB4C500D420CD8C30/image-size/large?v=v2&px=999 "inc5.jpg")


author: aryanp
body: Hi [@Nick H](/t5/user/viewprofilepage/user-id/2540930)   
I'm still seeing only the **Associated** alert in the Alerts dashboard.  

Sharing my sample incident rule,  
![Screenshot 2022-09-08 at 9.26.14 AM.png](https://community.atlassian.com/t5/image/serverpage/image-id/214880i98FC8BB93347F2A4/image-size/large?v=v2&px=999 "Screenshot 2022-09-08 at 9.26.14 AM.png")  

Here my incident rule is tied to **SumoLogic Alerts** service.  

<br />

![Screenshot 2022-09-08 at 9.29.46 AM.png](https://community.atlassian.com/t5/image/serverpage/image-id/214881i8E9FC44C9469375B/image-size/large?v=v2&px=999 "Screenshot 2022-09-08 at 9.29.46 AM.png")  

Added **Hyperexec** as the Owner team in Responders.  

However, I am still not receiving the notifications for **Hyperexec** team users.  

Only the Associated Alert is being generated.  
![Screenshot 2022-09-08 at 9.31.35 AM.png](https://community.atlassian.com/t5/image/serverpage/image-id/214882iAF522CA15E9C7078/image-size/large?v=v2&px=999 "Screenshot 2022-09-08 at 9.31.35 AM.png")  

<br />

Am I missing something here?  

As mentioned earlier , the responder alerts were getting generated and the notifications were also triggered. But the notifications stopped working all of a sudden and no Responder alerts are generated.


author: Nick H
body: Seems like the alert(s) is still being associated with an existing incident - whether the incident remains in an open state, or a resolved state. You should be able to check which incident that alert associated with here:

![asso1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/214893i2A3023D20EC02CA0/image-size/large?v=v2&px=999 "asso1.jpg")

It's **not** recommended to have an incident rule set to Match All like you shared - since it acts like a catch-all. Alerts cannot create an incident per alert when that is configured within the filter, so they'll continue associating to an existing incident.

There is an open feature request for that type of functionality that can followed, watched, and voted for here: <https://jira.atlassian.com/browse/OPSGENIE-73>

If you were to adjust that incident rule filter to include some conditions - or even delete it - I believe you'd notice the alerts acting normal and notifying your users as expected.


author: aryanp
body: Hi [@Nick H](/t5/user/viewprofilepage/user-id/2540930)   

Thanks for the information.  
After removing the incident rule, the notifications seem to be working.  

However,  
There's still another issue that I'm observing.  
When an open incident in SumoLogic is getting resolved\[manually/automatically\] ,   
the triggered open alert in Opsgenie is not getting closed automatically.  

Attaching the close alert integration rule that I have created,  

![Screenshot 2022-09-12 at 8.18.43 PM.png](https://community.atlassian.com/t5/image/serverpage/image-id/215517i35BD42E6226FA8DC/image-size/large?v=v2&px=999 "Screenshot 2022-09-12 at 8.18.43 PM.png")  

As a result of this, new notifications are not getting triggered from Opsgenie.  
And the SumoLogic incident is getting mapped to the already opened alert in opsgenie.


author: Nick H
body: Hi [@aryanp](/t5/user/viewprofilepage/user-id/5024871) ,

Glad notifications are working as expected now.

As for the SumoLogic alert not closing the Opsgenie alert, it could be due to your Create alert action filter. Maybe it's acting like a catch-all with the filter set to *Match All conditions*?

Regardless, try reviewing the [Logs](https://support.atlassian.com/opsgenie/docs/search-logs/) tab to see what data / request is being received by Opsgenie when the SumoLogic alert is being closed.

If no data / request is being received, then my guess is SumoLogic is not sending these to Opsgenie. If it is being received, review what might be happening - whether the alert is being [deduplicated](https://support.atlassian.com/opsgenie/docs/what-is-alert-de-duplication/), the alert is not matching on the Close alert action's filter / condition, etc.

[This article](https://community.atlassian.com/t5/Opsgenie-articles/Integration-not-creating-Opsgenie-alert/ba-p/2070678) may help as well. Although it's for when alerts are not being created, the troubleshooting steps would be the same to review.

If Opsgenie is receiving the close request, the two logs you most likely want to review are the Processed incomingData and Received integration request logs:

![logss1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/215529i60C93FE1920B7C7E/image-size/large?v=v2&px=999 "logss1.jpg")


Tags: cloud