Cloudwatch alerts do not automatically resolve events

#1

I would like events that are generated through CloudWatch to be resolved when an OK alarm is sent back.

I currently receive alarms for when the alarm is triggered and marked OK, but the OK alarm comes in as a suppressed event (and doesn’t mark the original opened event as resolved).

Is there any way to make this happen?

#2

@joey,

Can I have you use the Integration Guide to review what you have set up. An OK Status should resolve an Alarm, as detailed in the Guide’s FAQ.
If the issue still persists, please can you email support@pagerduty.com as we would require details specific to your account which we will not encourage to be shared here.

Thanks.

#3

I reached out to support and was advised that our event ruleset needed the ALARM messages to have the same dedup_id as the OK alarms. I did follow the integration guide you linked to set this up, but there was no mention of this (that guide needs to be updated a bit as it’s also confusing which HTTPS endpoint to use).

Thanks - this is solved.

#4
#5

Hey @jmct what specific actions did you take to match up that ID?

I’ve got the AWS CloudWatch integration setup in my PD service with “Correlate events by Event Name (only for AWS CloudWatch Events)” and Derive name from Alarm Name" but the AWS alarms will only ever open/trigger a PD alert. When the alarm goes normal (“OK”), it never resolves the PD alert, stays open indefinitely.

Both alarm state triggers “In alarm” and “OK” call https://events.pagerduty.com/integration/key omitted/enqueue so it isn’t making much sense why it wouldn’t resolve.

This is using the actual “Amazon Cloudwatch” integration type, not API v2 type.

#6

Hello Chris,

We would require account specific details to help resolve this issue. As we would not want such sensitive details shared here, please can you reach out to PagerDuty Support directly, support@pagerduty.com with links that detail the Incident in question you expected to be resolved. If you could provide a timestamp in UTC of when the OK State was attained, that would be great.
Do reference this ticket in your correspondence.

Regards,

1 Like
#7

For future reference, the specific field/ID to match is “Correlate events by” within the PD Amazon CloudWatch integration configuration.

My issue was I was using “Event Name (only for AWS CloudWatch Events)” which was not matched. Once I switched to “Alarm Name” everything worked as expected.

#8

Great. Thanks for letting us know.

Regards,