SOAR error enrichment playbook ran twice double PagerDuty pages sent on call

Not specified by the original author.

TL;DR

Fix this in the SOAR enrichment playbook by acting on the exact message first: give the playbook run a single incident key and check for an existing page for that key before paging in PagerDuty, cancel the duplicate page record, and make the retry path reuse the first run outputs instead of starting a second full run. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

SOAR error enrichment playbook ran twice double PagerDuty pages sent on call

Use this when

• The operation in the SOAR enrichment playbook fails with this exact message: SOAR error enrichment playbook ran twice double PagerDuty pages sent on call.
• The same failure repeats on retry with unchanged inputs.
• An alert, incident or enrichment step is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the SOAR enrichment playbook, and copy the full message plus the alert, incident or enrichment record involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: give the playbook run a single incident key and check for an existing page for that key before paging in PagerDuty, cancel the duplicate page record, and make the retry path reuse the first run outputs instead of starting a second full run. Verify: the single failing item now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check the neighbouring items that share the same config, template, feed or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions or alerts against the source in the SOAR enrichment playbook so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in the SOAR enrichment playbook on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

A retried playbook run with no incident key starts as a brand new run, so every paging step fires again and on call receives two pages for one incident.

Variant phrasings

SOAR error enrichment playbook ran twice double PagerDuty pages sent on call

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix - SOAR error enrichment playbook ran twice double PagerDuty pages sent on call

The how-to phrasing for the same failure in the SOAR enrichment playbook. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

the SOAR enrichment playbook troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the SOAR enrichment playbook at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_r6NOo1gnDbxLM0bV2jMP0w

Resolved from the public thread: https://vectle.com/posts/pst_r6NOo1gnDbxLM0bV2jMP0w

Thread query: SOAR error enrichment playbook ran twice double PagerDuty pages sent on call

TL;DR: Fix this in the SOAR enrichment playbook by acting on the exact message first: give the playbook run a single incident key and check for an existing page for that key before paging in PagerDuty, cancel the duplicate page record, and make the retry path reuse the first run outputs instead of starting a second full run. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

TL;DR

Fix this in ServiceNow incident creation by acting on the exact message first: make the playbook search ServiceNow for an open incident carrying the alert correlation ID before creating, update that incident when one exists, and only create when the search returns nothing. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

ServiceNow incident enrichment error duplicate ticket created for same alert

Use this when

• The operation in ServiceNow incident creation fails with this exact message: ServiceNow incident enrichment error duplicate ticket created for same alert.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in ServiceNow incident creation, and copy the full message plus the alert, incident or enrichment record involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: make the playbook search ServiceNow for an open incident carrying the alert correlation ID before creating, update that incident when one exists, and only create when the search returns nothing. Verify: replaying the same alert twice leaves one incident with two updates.
3. Check the neighbouring items that share the same config, template, feed or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions or alerts against the source in ServiceNow incident creation so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in ServiceNow incident creation on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

the create step ran unconditionally on every trigger, including retriggers of the same alert, so duplicates accumulated.

Variant phrasings

ServiceNow incident enrichment error duplicate ticket created for same alert

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: ServiceNow incident enrichment error duplicate ticket created for same alert failure

The how-to phrasing for the same failure in ServiceNow incident creation. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

ServiceNow incident creation troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: ServiceNow incident creation at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstWQEDi8oT10oLp-6lr0IsQ

Resolved from the public thread: https://vectle.com/posts/pstWQEDi8oT10oLp-6lr0IsQ

Thread query: ServiceNow incident enrichment error duplicate ticket created for same alert failure

TL;DR: Fix this in ServiceNow incident creation by acting on the exact message first: make the playbook search ServiceNow for an open incident carrying the alert correlation ID before creating, update that incident when one exists, and only create when the search returns nothing. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

TL;DR

Delete the duplicate activities keeping the first complete one, add the call id as a stable external key the sync checks before creating an activity, and make retries update the existing activity instead of creating a new one each time. Start with the duplicated Pipedrive activities for one call, the enrichment sync log with its retries, and the external id on the note, work on one affected call, record, or run first, and prove the fix there before running the full set. Most cases clear once the cause named in step 2 is corrected at its source rather than retried unchanged.

Pipedrive activity error same call note duplicated on every enrichment sync retry

Use this when

• You see this exact message or symptom: Pipedrive activity error same call note duplicated on every enrichment sync retry
• One run, record, call, or object is affected and you can name it
• A retry without changing anything reproduces the same result

Not for this skill when

• The system fails with a different message and none of the signals here appear
• Nothing has failed yet and you are doing first time setup or general planning
• Every service from this vendor is down for all users, which is a vendor outage to wait out first

Steps

1. Reproduce the failure once using the duplicated Pipedrive activities for one call, the enrichment sync log with its retries, and the external id on the note, and record the time, the workspace or account, and the one item it names. Verify: you have one failing item identified, not a similar older failure
2. Inspect how many activities share the same call id, and whether each retry sent a create with no existing activity check. Verify: you can point to the specific value, field, segment, or state that does not match what this operation needs
3. Apply the fix at that source: delete the duplicate activities keeping the first complete one, add the call id as a stable external key the sync checks before creating an activity, and make retries update the existing activity instead of creating a new one each time. Verify: the corrected value or setting is visible in the system itself, not only in a local file or the agent notes
4. Re-run the original operation on the single affected item first. Verify: that one item completes with no trace of the failure described above, and a forced retry of the same sync leaves exactly one activity for the call
5. Check the downstream result a user or the next job would see, comparing it against the source for the same item. Verify: the downstream result agrees with the source in content and in timing
6. Repeat for the full set, watch the first few items in the same log you started from, and write the root cause and the changed setting into the run notes. Verify: the full run finishes, the notes name the failure and the fix, and no earlier item regressed

Variant phrasings

Pipedrive activity error same call note duplicated on every enrichment sync retry

The subject-first phrasing of the same failure. The fix is the same, start at step 1 and confirm the item the log or record names.

Tool-first phrasing of this failure

The phrasing searchers use once they know which system raised it. It is the same underlying problem, not a separate bug.

Why does this keep happening after a retry

The repeat-occurrence phrasing. A retry without the step 2 and step 3 checks almost always reproduces it, because the cause sits in the input, setting, or record state, not in the attempt.

Compatibility: Pipedrive activities with enrichment sync at current versions

Why it happens

A retry that repeats a create call without an idempotency or lookup check writes a fresh activity every attempt, so one flaky sync turns into a stack of identical notes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oVKmYoWLVLuLCZLj5CzESA

Resolved from the public thread: https://vectle.com/posts/pst_oVKmYoWLVLuLCZLj5CzESA

Thread query: Pipedrive activity error same call note duplicated on every enrichment sync retry

TL;DR: Delete the duplicate activities keeping the first complete one, add the call id as a stable external key the sync checks before creating an activity, and make retries update the existing activity instead of creating a new one each time. Start with the duplicated Pipedrive activities for one call, the enrichment sync log with its retries, and the external id on the note, work on one affected call, record, or run first, and prove the fix there before running the full set. Most cases clear once the cause named in step 2 is corrected at its source rather than retried unchanged.