Closing Alerts

For all actions, except the Console action, where the alerts can be monitored and closed from within the Enterprise Console, you need to add a:

CLOSE *CURRENT

action to ensure that the alert is closed.

Failure to do so can result in a large number of alerts appearing in the Alert Log that then need to be closed manually.

In order that the Close action and other running actions are completed, there are two types of action completion; normal and forced, which are set automatically by the software.

• Normal action - Only ever completed if the alert is open.

• Forced action - Completed even if the alert is closed.

This means that actions defined to run at the same action sequence level and with the same delay time (message queue rules only) are forced to complete even if one of them is a Close action that is triggered first.

If a delay is specified, the forced flag is not set until the delay expires. Therefore, delayed actions are stopped if the alert is closed before the delay expires, but once the delay has expired, the actions are set to forced so that are guaranteed to complete even though the alert is now closed.

Therefore, not setting a CLOSE *CURRENT action also means that actions that are not forced, are cancelled when the alert is manually closed.

Example One

Action Delay

CLOSE ALERT (*CURRENT) 0

SNDTXT SENDTO (ABMAIL) MSGTXT(&SYSNAME - &ALERT) 0

SNDTXT SENDTO (ABPHONE) MSGTXT(&SYSNAME - &ALERT) 0

When the alert is raised, the two SNDTXT actions are set to forced which means that they run, even if the Close action is completed first.

Example Two

Action Delay

SNDTXT SENDTO(ABMAIL) MSGTXT(&SYSNAME - &ALERT) 0

SNDTXT SENDTO(ABPHONE) MSGTXT(&SYSNAME - &ALERT) 0

In this example there is no Close action, so the actions are not set to forced. These are likely to be actioned anyway, but if there was a communications problem or a big queue of messages waiting to be sent, the SNDTXT actions would be cancelled if the alert was closed before they could be sent.

Example Three

Action Delay

SNDTXT SENDTO(ABMAIL) MSGTXT(&SYSNAME - &ALERT) 60

SNDTXT SENDTO(ABPHONE) MSGTXT(&SYSNAME - &ALERT) 60

CLOSE ALERT(*CURRENT) 600

This deals with multiple actions but with different delay periods. The two SNDTXT actions are not forced as there is no Close action with the same delay.

The SNDTXT actions are attempted and the alert is then closed nine minutes later. If the two SNDTXT actions had not completed by then, they are cancelled.

Example Four

Action Delay

SNDTXT SENDTO(ABMAIL) MSGTXT(&SYSNAME - &ALERT) 600

SNDTXT SENDTO(ABPHONE) MSGTXT(&SYSNAME - &ALERT) 600

CLOSE ALERT(*CURRENT) 600

This example demonstrates an important point about forcing actions. The force is only set when the delay has expired. The actions above run ten minutes after the alert is raised. If the alert is closed before the ten minutes have expired, all three actions are cancelled. However, if the delay expires and the alert is still open, the two SNDTXT actions are set to forced and all three actions are completed. As the SNDTXT actions are set to force, they are completed even if the Close action is processed first by the Action Monitors.

Closing alerts within an Action Schedule

When using an action schedule, actions that are CLOSED are treated as the equivalent to PASS for the purpose of Condition checking. For example, in a schedule containing the following actions:

10 *ALL CONSOLE ENTCON

20 IF 10 *FAIL CONSOLE *LOCAL

30 IF 10 *PASS AND *20 *FAIL CLOSE

If action 10 is successful, Action 20 is CLOSED. Action 30 is then treated as PASSED.

Calling a user program when closing alerts

It is possible to call a user created program when a local system alert is closed. This is controlled by system default HAL/ALTCLOSEEXITPGM. If set to *NONE no program is called, if set to a program the program is called every time a local system alert is closed with the following parameters passed:

*DEC 9	Alert ID of the alert that was closed
*CHAR 1	The method used to close the alert
*CHAR 20	The user who closed the alert. If the alert was closed from an IBM i system, this is the user ID of the user who closed it. If the alert was closed from a PC Enterprise Console, this is the PC logon name of the user who closed it
*CHAR 8	If the alert was closed by a remote Halcyon environment, this is the remote location name of that environment as defined on the local environment
*CHAR 32	If the alert was closed by a PC Enterprise Console, this is the PC name of the system on which the Enterprise Console was running