Almost all of our alerts are feeding our incident tracking system by opening/closing incidents when an alert happens within the environment. Since this monitoring is statefull the incident will be opened when the alert occurs and closed after the monitoring has detected the issue is resolved. This is resulting in users not entering in any comments around the error that happened because when they fix the issue the incident will close itself by the time they can comment. Ideally, some of the more higher priority incidents should have user comments entered regardless if the incident is closed already because I think it's important to understand what sort of problem actually happened, impact, and resolution. How can I make these teams the incidents are assigned to accountable and get them to take ownership of the errors that are occurring? Has anyone else ran into situations where people are letting high priority incidents go undocumented?
↧