Alert automation troubleshooting

Resolve the issues that can occur when you use alert automation.

Duplicate tickets are created for the same alert

The most likely cause is a cloned copy of the Alert automation workflow. If a clone is enabled, both workflows process the same alerts, and each one creates a ticket.

To fix this, go to Automation > Cyber Studio > Workflows, and disable or delete the cloned workflow. Do not clone the Alert automation workflow. For more information, see Enabling a workflow and Deleting a workflow.

Also check that the Alert automation workflow is enabled only at the partner tenant level, and not for individual client tenants. For more information, see Assigning workflows.

The diagnosis does not include information from the device

To run commands on a device, for example to check what is using the disk space, the diagnosis agent needs a remote management plan with the Remote command-line interface setting enabled on that device. If the plan is not applied, the agent cannot run commands, and recommends applying the plan in its next steps.

To fix this, apply a remote management plan with the Remote command-line interface setting enabled to the device. Alternatively, when you remediate the ticket with Acronis AI, it can apply the plan for you, if you agree to it. For more information, see Reviewing an AI-diagnosed ticket.

Agent steps cannot be viewed in the Protection console

The details of agent steps in a workflow are shown only in Cyber Console. If you open the Alert automation workflow in the Protection console, a warning is shown instead of the agent step details.

A diagnosis or recommended action is incorrect

Diagnoses and recommended actions are based on recipes that Acronis maintains for each alert type. If a diagnosis or a recommended action is incorrect or not useful, contact Acronis support, and include the ticket details. Acronis can investigate the issue, and update the recipe to improve later diagnoses.