Close Problem: Impact of Anomaly Detection and Problem flow when manually Closing a Problem

[jmccullough3]

What are the potential impacts on monitoring (anomaly detection, problem re-occurrence, frequent detection, ServiceNow incidents, Davis, etc) when a Problem continues to persist but it is manually closed using the "Close Problem" button? 

My current understanding is this: If there is a problem like CPU above threshold which gets closed by "Close Problem" button while the CPU remains above threshold then it will: (all of the below)

1)Clear from the Dynatrace Problem panel (Red to Gray)

2)Not re-occur based on any time frame

3)Not send a new alert to ServiceNow for another Incident

4)Not create it as a Frequent Issues situation

Only if the CPU drops below the threshold for it's configured period of time and then comes back above the threshold will a new Problem appear, and a new alert be sent to SeviceNow.

[mrc15816 · Accepted solution]

@jmccullough3 my understanding and experience is if you close a problem but the issue persists you wouldn’t get another problem card till the initial problem is closed. All the other components you listed would not be modified or used.

[marina_pollehn · Accepted solution]

If you manually close a problem but the conditions return to normal (as @mrc15816 said) for at least the duration of your set sliding window, it will be re-opened if the anomaly conditions are fulfilled again. So for example, after 3 faulty timeframe samples were found again after 3 non-faulty ones, a new problem will be raised, regardless of if you closed one before. Yes, it will first go from red to grey, but then it will not resurface but create an entirely new problem after a few minutes if you did not change anything in the anomaly detection and if it returned to normal in between. 

If the same type of incident appears again, and the new problem is opened for the same scenario again, a new  ServiceNow ticket will be created.

In the scenario that the CPU simply remains high, you will indeed have a grey problem, no new ServiceNow tickets and no new problems :). 

[marina_pollehn · Accepted solution]

I believe the frequent issue detection to be fully independent from the manual closing of problems (as far as I know it is also based on events not problems directly).