What are Incidents? › How Incidents are Closed

How Incidents are Closed

An incident remains open until it is automatically closed. For example, the severity of the condition changes, but the metrics still violate the degraded or excessive threshold. The incident is updated to reflect the change in severity, but the incident is not closed.

Incidents are closed when:

• They have been open for 24 hours. If the problem still occurs after 24 hours, a new incident is opened.
• The performance condition that violated the threshold has not been detected for one full clock hour of data collection. A full clock hour is not the same as 60 minutes of time. A full clock hour starts at the beginning of an hour and ends at the beginning of the next hour.

Incident types can change. A call quality threshold violation overrides a call setup violation when they affect the same pair of reporting components. An incident remains open for that pair, but the type of incident changes to call quality when a call quality threshold violation is detected.

Note: You can acknowledge an incident for a degraded performance condition and not be aware that the performance condition has deteriorated further. A degraded incident can change to severe status while still appearing as acknowledged in incident reports. As a best practice, acknowledge only those incidents that you have taken steps to address.