Knowledge Base

Alert is firing, but sent data looks okay

Question

I set an alert condition for an IP. The condition is to send an alert when there are 3 incidents over 2000ms in the last 6 pings. The max e-mail frequency is 30 minutes, and the duration to wait for worse condition is zero. However, I sometimes received alerts in which the most recent 6 pings, as shown in the alert e-mail, are below the threshold. What did I do wrong to create these false alerts?

Solution

Check to make sure that your 'Maximum samples to hold in memory' isn't set too low. The setup in this case had e-mails going out at maximum every 30 minutes. The 'Max samples in memory' was actually set to only hold about 25 minutes worth of data at a time, so sometimes the alert would go out based on conditions that had already dropped out of memory.

To fix this problem, just change the 'Max samples to hold in memory' to hold at least the amount of time your maximum e-mail frequency is, preferably a bit more (as the history files that can be included in the e-mails can actually show more data than this).

To change this setting, access the Auto-Save option screen in Edit -> Options.


Article Rating (1 Votes)

Rate this article


Article Info

Article Number: 54 | Last Updated: November 11, 2013

This article has been viewed 6453 times since December 27, 2005

Filed Under: Alerts

Attachments

There are no attachments for this article.