Pete,

If I set up an email alert for default 500ms, the site goes down, and while it is down, PP performs a tracert -- what happens? Does my alert go off? Shouldn't there be other ways to trigger an alert: PL% > X%.

Second, it seems a bit difficult to set up the alert. You have to know to right-click on the IP, and set it up that way. It seems like there should be a menu item, or a button for each IP.

1)

A lost packet will always qualify as greater than whatever number you enter. So lets say you set up an alert to fire when 2 of the last 10 samples. If you get 2 high latency packets (say 800 and 900), the alert will fire. In addition, if you get 2 lost packets, the alert will fire (ie: 20% packet loss in this case).

If you use 9999 instead of 500 for the latency number, then you'll be looking for packet loss - not just high latency (as the default time to wait for a packet is 9999 ms - anything more than this is a lost packet).

So using this same mechanism, you can trigger on high latency - which always includes packet loss, or just packet loss. You can get to whatever percentage of target packet loss you want to by changing the number of samples to look at and to alert on - ie: 23 of the last 100 would be 23% packet loss, and 155 of the last 1000 is 15.5% packet loss (although that's an unreasonably high number of packets to look at).

2)

We're currently toying with some ways to change this a bit, but haven't come up with a perfect mechanism yet. Are you suggesting that we just add a menu option (from the main menu) for alert association with the currently selected host?

Thanks for the feedback.

- Pete

I'd suggest that this be an option, maybe a button, from within the Alerts setup menu. So no new menu options.

The "Traces to Examine" and "Alert when" could be clearer. How about "Alert when ____ of the last ____ traces are (dropdown options: slower than, lost packets) ____ ms." Make the ____ ms disappear when "lost packets" is chosen.

To me, that would be a ton clearer. Took me a minute to decipher this screen when I first saw it.

How about "Action" instead of "Event Type"?

HTH,
Stephen