Automatic acknowledge on IMC alarms by a specific user

[PacketLoss]

Hello,

we are noticing that a specific alarm of a specific device, every time the event occour, the acknowledge field always reports the name of a specific user. The fact is that that user didn't aknowledged the alarms because he was not working in that time! What can be the cause of this behaviour? Every time that particular device il rebooted, we see the "cold start" alarm on IMC under "Real Time Alarms" with the user name of a specific person (always the same) in the acknowledge field. How we can get rid of this thing that is happening?

Thank You and kind regards

Giulia

[jguse]

Hello,

It sounds like a really odd issue... I'm not familiar with any feature in iMC existing that would automatically acknowledge an alarm. The "Acknowledge" feature is normally there to allow users to manually 'assign themselves' for dealing with a particular alarm, and it wouldn't make sense to me if this somehow happened automatically. Only the 'Recover' option, which considers the alarm resolved and resets the device status, can normally be configured to happen automatically.

What iMC version are you running? Does the affected user have any specific settings (like permissions to access) for that device? Maybe you could try deleting that particular affected device and re-adding it to IMC if possible, and see if that helps?

[PacketLoss]

Hello Justin,

we are running iMC version PLAT 7.3 (E0705P12), I don't see any special permission or settings on the user, deleting and re-adding the device at the moment iunfortunately s not possible because the issue is not object of an official ticket but is only a "private" request. The user has privileges of "maintainer"...I noticed somethig strange:

 When I click on the event that happened today, precisely on the description of "cold start", I am sent back to an old event of the same type where the user appears to have acknowledged. Is it possible that the aknowlegde is being "inherited" from an old alarm? If I click on today's alarm, I get an alarm from 2 weeks ago ... even seeing the acknowledge date of today's event, I see that the acknowledgment dates back to 2 weeks ago and this would be technically impossible given that the event dates back to today. It is as if IMC was "recycling" an old alarm to report all events similar to the one from 2 weeks ago that are taking place. Is such a thing possible? What can this be due to?

Thank You and kind regards

Giulia

[jguse]

Hello Giulia,

You could try clearing the browser cache if you haven't already, though I suspect it's more likely an issue within the DB. I can't think of any feature that would show such strange behavior, and there are no known issues like this. There's features that could create 'alarm relations' in terms of one alarm causing the other, but nothing with such symptoms.

What if you delete the alarm from two weeks ago, and then re-open a current event of the same type?