Release Notes › Known Issues › Queries and Reports › Some Action Alert Jobs Fail When Scheduled Too Frequently

Some Action Alert Jobs Fail When Scheduled Too Frequently

Symptom:

When an action alert that queries events generated during a given time interval is scheduled to run more frequently than that time interval, the overlapping jobs can fail. The following message displays: "Failed to generate the alert as the previous query is in progress". For example, if you wanted to query for specific events that were generated during the last three hours, but set the query to run every hour, the first job would not have time to complete before the second job begins. In this case, CA Enterprise Log Manager continues processing the first scheduled job and sends failure messages for the next two scheduled jobs. As soon as the 3 hour interval elapses, an alert is sent if any events meeting the query criteria occurred, and the next run of this alert begins processing.

Solution:

If you specify only a Date Range Selection in the Result Conditions step, select a recurrence interval equal to the interval you set for Date Range Selection. For example, if you wanted to query for events meeting specific criteria that were generated during the last three hours, you would set the Date Range Selection in the Result Conditions step as follows:

Dynamic End Time: 'now' '-2 minutes'

Dynamic Start Time: 'now' '-182 minutes'

When you define the schedule, you should set the Recurrence Interval in the Schedule Jobs step to a value equal to 3 hours (180 minutes) as follows:

Recurrence Interval: 3 hours

Setting the same query interval and recurrence interval ensures that the every event occurrence meeting the query criteria would be recorded in a generated alert. This recommendation does not apply if you specify a time interval for grouped events.