Incident Log

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/Incident-Log

The Incident Log is a simple record of what you did about a problem: "this alert fired, here is what I did." It is there so the work is written down after the alert has gone, and so the next person (or you, next term) can see what was tried.

It is not a ticketing system. There are no queues, no assignment and no deadlines. Each entry is a title, some notes, an author and a time.

Open it from the Incident Log item in the sidebar, or at https://<server-address>:8443/incidents. Admin and technician accounts can use it. An SLT account cannot see it.

Logging an incident #

There are two ways in.

On its own. Click + Log an incident at the top right. A form opens:

What happened? -- a short title, up to 200 characters. Required. For example, "Re-enabled BitLocker on LAB-PC-12".
What did you do? -- optional notes. Steps taken, who you spoke to, anything worth remembering next time. Line breaks are kept.

Click Save incident. If the title is empty the form asks for one.

From an alert. On the Alerts page, click Log what you did on an alert. The Incident Log opens with the form already showing, the title filled in as "Dealt with:" followed by the alert's title, and a note saying which alert it is linked to. You can change the title before saving. If the linked alert no longer exists when you save, the log refuses the entry and says so.

The list #

Incidents are listed newest first. Each one shows:

A status chip: OPEN (amber) or CLOSED (green). Closed entries are slightly faded.
The title, then the notes.
If it was started from an alert, a Linked alert line with that alert's title, coloured by its severity.
A line at the bottom: who logged it, how long ago, and "edited ..." with the time if it has been changed since.

The author is taken from the account that was signed in when the entry was saved. You cannot type a different name.

The buttons at the top of the list (Open, Closed, All) filter it. The page opens on Open. The line under the page title counts the incidents shown.

What the buttons do #

Edit -- opens the same form with the title and notes filled in, so you can correct or add to them. Saving updates the entry and shows "edited" on it. The link to the alert stays as it was. You cannot add or change it after the entry has been saved.
Close -- marks the incident as done. It moves from the Open list to the Closed list.
Reopen -- on a closed incident, puts it back to open.
Related -- only on an incident that is linked to an alert. It shows other incidents on the same connector in the last 30 days, with their status and how long ago. Click one of their titles to open it for editing. Click Hide related to close the panel. If there are none it says "No other incidents on this connector in the last 30 days." An incident with no linked alert has nothing to match on, so it has no Related button.

Nothing is deleted #

Incidents are never deleted. You close them when the work is done.

Admin accounts also get a Hide button on each entry, for a mistaken or junk entry. Hiding takes it out of the normal list but keeps the record. Tick Show hidden (it appears for admins only) to see hidden entries, marked HIDDEN with a dashed border, and click Restore to bring one back. A technician cannot hide anything and never sees hidden entries.

The log is stored in Groundskeeper's database, so it is included when you back up and restore. See Backup and Restore.

Switching it off #

The Incident Log is on by default. If you set incidents: enabled: false in config.yaml, both the log's API and its page answer "not found". The Incident Log item stays in the sidebar, but it leads to a plain "Incident log is disabled" page.