Hi, Matt.

How often are you getting emails? With Maximum email frequency set at 180 minutes, you should only be getting emails once every 180 minutes.

The 180 minutes rule only applies to that specific alert instance, though, so if you have the same alert tied to multiple targets, you may be getting alerted multiple times because each target handles the alert separately. In version 3.20, this would happen whenever you tied an alert to an intermediate hop that participated in multiple destinations. With 3.30, though, you can do it globally (like 3.20) or locally (although this requires the use of a workspace).

You can also do this from a different angle. If you set your "samples to examine" to something close to 3 hours worth (in your case, this would be 4320 samples @ 24 per minute), then you can keep the alert firing for 3 hours. If you get a period of packet loss, it will keep the alert firing for as long as those packets are "in scope" of the 4320 samples. Once 3 hours has past, then the packets that fired the alert will go out of scope, and as long as no other bad packets had happened along the way, the alert would go back to "everything is OK" again. Increasing the samples to examine can be effective in managing alerts that regularly go on/off/on/off/on/off, and you don't want to be alerted to the short-term flaps, but just once you get bad conditions, then good conditions.

We cover some of these techniques here:

http://www.nessoft.com/kb/81

Let me know where this leaves you. We've got some other tricks in the bag, but this handles most cases.

- Pete