Incident Rules are not triggering for Alerts when created
Asked by Ste404:

Hi there,

Just working through Opsgenie to get a better understanding of it and am stuck with Incident Rules.

I have alerts coming through for the Billing Service when I create an issue in JSM, works well.

I have a pretty wide Incident Rule in place to just use as a trigger to see it in action, but it won't fire.

![Capture.JPG](https://community.atlassian.com/t5/image/serverpage/image-id/212179i3C0C17540354DC77/image-size/large?v=v2&px=999 "Capture.JPG")

As far as I can understand shouldn't this just create an incident based on any Alert coming in for the impacted service of Billing. I expected it to create a P3 alert with the information in the relevant fields.

I have added other rules to look for specific Status or words also but nothing is firing.

Is there something specific I should be looking at to get this up and running.

I am the admin of the team that is bound to the Billing service and is added as responders to the issue also.

Thanks


Answers:
author: Nick H
body: Hi [@Ste404](/t5/user/viewprofilepage/user-id/4984517) ,

A few things to check with your current configuration.

1 - Make sure that the JSM issues are sending to the same team that has this incident rule configured. Incidents rules are only reviewed when an alert is sent to the same team.

2 - If above is true, review if the alert(s) are [associating](https://support.atlassian.com/opsgenie/docs/associate-an-alert-with-an-incident/) with an existing incidents.

I'm sure the idea with your configuration is to have each JSM issue create a new incident. But realistically what would happen is one JSM issue would create an incident. If the incident remains opens, and more issues are created, they'd be associated to the existing incident.

It's not possible with that filter to have each issue (or alert) create its own incident. We have a feature request for this you can follow, watch and vote for here: <https://jira.atlassian.com/browse/OPSGENIE-73>

An easy way of checking whether or not the issues / alerts are associating to an incident is in the Alerts tab, or under any existing incidents:

![assoc1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/212313i5BB85AAC62BA0EF4/image-size/large?v=v2&px=999 "assoc1.jpg")

![assoc2.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/212314iD0838227A225D6E6/image-size/large?v=v2&px=999 "assoc2.jpg")

comments: author: Ste404
body: My theory was that when alerts arrived and they would meet certain conditions (i.e. SMS Gateway as the service and P2 or above then an incident would be created based on the constructed incident rule. I can't get the rule to fire with the Match All let alone anything specific in the matching conditions.

It is not a incident per every alert, I was testing from what I thought was the most wide spread angle possible.

My alerts come in from JSM with the correct team bound to the Service that was selected from Insight, just not sure why the incidents are not firing.

I'll dig deeper.


author: Nick H
body: Hi [@Ste404](/t5/user/viewprofilepage/user-id/4984517) ,

You're theory is correct, and I'm not entirely sure why an incident is not being created when you have the incident rule's filter set to match all alerts.

Here is a test to show what *should*happen when an incident rule is set to match all alerts:

![ir1.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/212422iE8A935D072204B00/image-size/large?v=v2&px=999 "ir1.jpg")

JSM issue creates Opsgenie alert:

![ir2.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/212423iBCDC0D6FF503D9C2/image-size/large?v=v2&px=999 "ir2.jpg")

Opsgenie alert is automated into an incident:![ir3.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/212424i926395BD352566C8/image-size/large?v=v2&px=999 "ir3.jpg")


author: Ste404
body: hey I found something weird. There is an incident created, I created one to make sure it wasn't permissions and such.

The alert rule is firing but it is associating the alerts with this incident and not creating new incidents.

Not quite how I need this to work?!


author: Ste404
body: aaahh the alerts were being picked up by the catch all and being associated with the incident that in place. I got rid of everything, created two rules that had specific phrases in the Description condition and manually created two alerts and two incidents were created.

I created another alert that met one of the rules description conditions and no new incident was created but it was associated with the incident that the rule was relevant to.


Tags: incident