Data driven rule is firing alarms repeatedly even if the condition remains active (4379049)

An alarm from a data driven rule is firing repeatedly every hour even without change in data. The alarm fires with the same values even if it has not been cleared.

The expected behavior is for a data driven rule to not fire repeated alarms while the problem condition remains active; only if the alarm gets cleared and the evaluated condition is true again a new alarm should fire.

The amount of Current Alarms in the system exceeds the maximum of 50000 alarms that can be cached by the Alarm Service. It is possible that the Alarm Service is unable to cache the additional alarms and therefore searching the cache may not be returning those alarms causing the Alarm Service to generate a new one. 

Example of current alarm totals from the Diagnostic Snapshot:

==================== Alarm Service =========================
Current alarm totals: 
Warning: 24822
Critical: 706
Fatal: 25682

Review alarms in the system to reduce the number of Current Alarms.

The script in section "Alarms counter break down by source type (Rule Name)" from solution Total Alarms counter (acknowledged, cleared, current, historical) and Purge (4295903) can be used to identify the rules that are generating most of the alarms.

Once problematic rules have been identified, consider making adjustments depending on the rule and environment needs; for example, this could include addressing the underlaying condition causing the alarm, tuning the alarm thresholds, disabling alarms or clearing old alarms.

Note: Clearing and purging alarms may provide a temporary solution, but it is recommended to understand and address the root causes of why the alarms are triggered to reduce the amount of recurrent alarms in the system.

For more information on clearing and purging alarms, refer to the following articles:

• Detailed information on clearing and purging alarms (4309807)
• How to Purge Alarms? How to schedule purging of Alarms? (4289502)