I have been working on the API transport and tuning the message contents being sent into our Telemetry system. one thing that I cannot figure out is why Severity: %severity never gets updated to clear when a “recovered from” message is sent. Below is my Device Up/Down alert template.
BACKBONE :: %title
Severity: %severity
{if %state == 0}Time elapsed: %elapsed{/if}
Timestamp: %timestamp
Unique-ID: %uid
Rule: {if %name}%name{else}%rule{/if}
{if %faults}
{foreach %faults}
Device Down: %value.sysName
Device Location: %value.location
{/foreach}
{/if}
And this is what i see in the message from the API transport
CDG1 :: Device cdg1-r123-hl01.network.cloud.xxxxx.net recovered from Port Errors
Severity: critical
Time elapsed: 5m 2s
Timestamp: 2017-11-29 22:10:33
Unique-ID: 15725
Rule: Port Errors
It would be very useful if Severity: critical was representative of the current state so it would be Severity: cleared / ok / or something other than critical