snoozeweb / snooze

Snooze - Log aggregation and alerting
GNU Affero General Public License v3.0
10 stars 6 forks source link

Manual actions #17

Closed tester22 closed 11 months ago

tester22 commented 1 year ago

Hi,

I am investigating using Snooze for our monitoring spoc. There is one feature that I am missing and I wonder if this is something that is on the road map.

Today some of the systems that generate alerts in our environment are too unspecific in the alert body (these systems can’t be changed). In our current solution we have an action button that can be triggered by the monitoring team if they after some investigation identifies the correct team.

Is this on the roadmap? For example to have an button next to the acknowledge button to trigger an action?

Nemega commented 1 year ago

Hello !

Sorry for the late reply. This is an interesting use case. In summary you want to trigger an action related to a specific alert directly from the Alert page, in case for example if the alert did not get to the correct team. You would click the button and select an action (for example send a mail, trigger a webhook, etc...). In your use case there is nothing you can do about the alert to identify which team to escalate, that is why you need a button to force the escalation. For now the alert page is already pretty busy, so an additional button might make it a little bit too cramped. Not impossible but let me think about it first. For now there is a correct workaround for you: the monitoring team first acknowledges the alert, then they can re-escalate it while applying a modification (for example: set team = infra)m then in your notification page you would have the following condition: if (team == infra) then trigger ActionCallInfra.

What do you think ?

tester22 commented 1 year ago

Yes, today we also have actions like trigger runbook och create an ticket in the ticketing system. We are more or less handeling the spoc as an inbox where the operators are deciding if they or someone else should investigate the alert and then they have actions to escelate to other systems/teams.