I am looking at a ping plot where the graphical time line for hop 1 the last 24 hours, shows four red lines. I'm pinging every 5 seconds and including 17280 samples (24 hours worth). The error count for hop 1 is 4. I zoomed and scrolled the time line and see the first error is at 4:57:00pm yesterday.<br><br>The log file has entries for 4:09:22 and then 5:06:47 meaning nothing was logged near 4:57:00pm.<br><br>I am logging all pings that are over 1000ms using <br> Name=Log Slow Pings<br> TraceCount=1<br> AlertType=1<br> AlertSpeed=1000<br> BadTraceCount=1<br> SendSMTPEmail=0<br> PlayWave=0<br> WaveName=<br> EmailAddress=<br> MaxEMailFrequency=60<br> EMailWait=5<br> LogToFile=1<br><br>This trace has 5 hops all of which have the above monitor plus time lines enabled. None of the four errors showing on the time line were logged for hop 1. <br><br>Here is a combined log made from the PP log of errors plus what I see on the time line.<br>9/7/2000 4:54:00 PM Hop 1 time line shows error, not logged<br>9/6/2000 7:12:33 PM 20 17 21 * 30 This is on the hop 4 time line. Correct.<br>9/6/2000 9:54:10 PM Hops 1 and 3 on time line show errors, not logged<br>9/7/2000 2:39:05 AM Hop 1 time line shows error, not logged<br>9/7/2000 9:37:03 AM 55 * 14 23 24 This is on the hop 2 time line. Correct.<br>9/7/2000 12:50:40 PM 30 14 19 24 * This is on the hop 5 time line. Correct.<br>9/7/2000 1:15:22 PM 30 26 20 * 30 This is on the hop 4 time line. Correct.<br>9/7/2000 2:37:20 PM Hop 1 time line shows error, not logged<br>9/7/2000 3:35:34 PM 30 17 20 * 30 This is on the hop 4 time line. Correct.<br>(sorry the table looks so bad. I could line things up and email you a .TXT file)<br><br>Thus alerts firing for hops 2, 3, 4, and 5 are getting logged and also match the error counts in the top part of PP which is 4, 1, 1, 3, and 1. Via playing with the "includes" window I was able to verify that the error counts also match the time lines. The only inconsistency is that hop 1 items do not get logged and if there is a hop 1 plus another hop event at the same time then neither is logged.<br><br>Yes, hop one does have the alert set up for it and shows the [brackets] plus underline.<br><br>A related issue is my alert is supposed to log pings of 1000ms or more. The log file has 4,057 lines for the last 24 hours with none of them showing times over 1000ms (one item does have 911ms). Via playing with the graph scale and also sliding the 1 hour time line (resolution is high enough that there is a bar per ping) I can see that there are a number of >1000ms pings on hop 1 and none for hops 2 through 5 though once we were close at 958ms.<br><br>Thus slow pings on hop 1 are not getting logged and I am seeing thousands of events that should not have been logged including many that look like<br> 9/7/2000 3:34:09 PM 30 15 20 25 30 .<br><br>The extra logging bugs me. Sometimes the items are standalone such as <br>9/7/2000 1:15:27 PM 20 16 20 35 29 <br>9/7/2000 2:06:51 PM 30 15 20 25 30 <br>9/7/2000 2:30:58 PM 20 17 19 27 20 <br>9/7/2000 3:06:41 PM 30 16 20 46 30 <br><br>and other times PP ran for 30 minutes at a time logging every single round of pings which is how I ended up with thousands of lines. The long runs of logging generally have a failed ping as the second to last line and so I assume you are showing the ping results that lead up to an event trigger. If that's the case then it should be configurable as to how many lines are logged before/after the one that triggers the alert.<br><br><br>