When changing the condition of a rule which cause previously fired alarms to no longer evaluate as 'true'. Should pre-existing alarms be cleared manually now?
Multi-Severity type Rules are the only Rules that can auto-clear. Simple type rules do not auto-clear.
At the next collection, the newly modified condition that evaluates as 'not true' WILL auto clear the previous alarm that was fired for that severity.
When changing the scope of the your, you have to clear the pre-existing idle agent alerts manually after changing the rule's scoping.
Foglight auto-clears an alarm when a subsequent collection comes in and the CONDITION evaluates to 'no longer true', but not when a scope changes that excludes an object that was previously evaluated and fired upon.
© 2025 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center