similar alerts have several behaviours

[acalvo]

When defining different alerts in the etc/user/admin/search/local/savedsearches.conf, some of them work and some don't. However, searches work for all of them and list events as expected.

Example that works:

[alert1]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.to = mymail@mail.com
alert.expires = 7d
alert.suppress = 0
counttype = number of events
cron_schedule = * * * * *
dispatch.earliest_time = rt-1m
dispatch.latest_time = rt-30s
enableSched = 1
quantity = 0
relation = greater than
search = (componentsc = "RCG" OR componentsc = "AS" OR componentsc = "VCS") AND actionsc = "ECPRO"

Example that does not work:

[alert2]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.to = mymail@mail.com
alert.expires = 7d
alert.suppress = 0
alert.suppress.period = 20s
alert.track = 1
alert.severity = 4
counttype = number of events
cron_schedule = * * * * *
dispatch.earliest_time = rt-1m
dispatch.latest_time = rt-30s
enableSched = 1
quantity = 0
relation = greater than
search = (componentsc = "AS" OR componentsc = "VCS" OR componentsc = "RCG") AND actionsc = "RBACA" AND (outcomesc = "001" OR outcomesc = "010")

Thanks!

[the_wolverine · Accepted solution]

The issue was probably the value set to 1 not recognized. Per saved searches.conf.spec:

alert.track = true | false | auto
* Specifies whether to track the actions triggered by this scheduled search.
* auto  - determine whether to track or not based on the tracking setting of each action, 
* do not track scheduled searches that always trigger actions.
* true  - force alert tracking.
* false - disable alert tracking for this search.
* Defaults to auto.

[acalvo]

Nevermind, the error was alert.track = 1, it should be alert.track = auto