Problem events, status and status_transition

[henk_stobbe]

Good morning everybody,

If you look at dt.davis.problems life is simple:

	CLOSED	CLOSED
ACTIVE		REFRESHED
ACTIVE		UPDATED

But looking at the dt.davis.problems.snapshots life gets complicated (-; there are a lot more combo's available. Looking at the first line below. I get CREATED an ACTIVE problem, but CREATED a CLOSED problem??

What am I seeing wrong? 

ACTIVE	CLOSED	CREATED
	CLOSED	RECOVERED
ACTIVE	CLOSED	REFRESHED
ACTIVE		REOPENED
	CLOSED	TIMED-OUT
	CLOSED	RESOLVE
ACTIVE		UPDATED

[radek_jasinski · Accepted solution]

Hi Henk,

In the scenario you described, where the dt.davis.problems.snapshots dataset shows a combination like CREATED for both an ACTIVE and a CLOSED problem, this can initially seem confusing. However, this behavior is consistent with how Dynatrace logs and processes problem lifecycle events.

When a problem is CREATED, it simply means that Dynatrace has detected and logged an issue. A problem being marked as CLOSED immediately after being CREATED typically indicates a transient issue that resolved itself quickly or was automatically resolved by the system before the problem could be classified as ACTIVE for a longer period. In this case, Dynatrace logs both events: the creation of the problem and its resolution, which results in the problem showing as CREATED and CLOSED in the same lifecycle snapshot.

This is not a contradiction but rather an artifact of how Dynatrace tracks and reports on problems in real time, including those that may not persist long enough to affect the high-level problem list in dt.davis.problems.

Regards,
Radek

[henk_stobbe]

Hi Radek, thanks for your crystal clear answer👍

Thx Henk

[radek_jasinski]

You're welcome 🙂