Duplicated episodes created in the ITSI

Applicability

Description

It was found that duplicate episodes are being created in the ITSI.

Investigation

It was found that duplicate episodes are created in the ITSI. As a result, duplicate Service Now incidents are created.
There is no change in the correlation search and notable event aggregation policy. 
For example:
The first notable event is created on 13/05 and an episode is created and it's not closed.  
But when the 2nd notable event is created on 18/05, the new event will NOT go into the same episode but a new episode is created.

Suppose all the events are going into the same episode until the episode is closed. 

Resolution

If having NEAP keeping Episodes active for more than the default 24h, need to increase the group_restore_lookback_time in the rules engine properties.
For the expiry of the episode, it would be 24 hours.  
After 24 hours inactive, it will be longer than the lookback time, so a new episode is created. 

It is needed to increase the time to 7 days or more.
This change is made in ~/etc/apps/SA-ITOA/local/itsi_rules_engine.properties .
 

group_restore_lookback_time = 168

The default value is not in the default folder file and it's hardcoded but it should be overwritten by the file in the local folder. 
After the change, restart the Java rule engine process to make it effective

Related Links