avoid alert flooding

[giulianoz]

Hello,
Is there a simple way to add a delay between a trigger turns on and the alert is sent ? possibly only when the trigger goes on and not when it turns off

ie: I'm monitoring a router interface using net.ping. when the ping isn't responding for 5 minutes send an alert. when the ping became responsive send the alert immediately. I tried to use " ({Template_Router:icmpping.last(0)}=0)&({Template_ Router:icmpping.sum(300)}=0)" but the alert is sent immediately.

thanks

[xs-]

Try:
{Template_Router:icmpping.max(300)}=0

If the maximum value of all polls is 0 over 5 min (meaning 5 min down) then fire trigger.
If you have a flapping device or a borked network connection, this will not detect the problem tho. If your ping interval is 1 min in the above example, 5 sequential pings must fail in order for the trigger to fire. In case of 4 failed and 1 successfull pings, the trigger will not fire.

[giulianoz]

thanks for the reply, but it doesn't seem to work. The alert is sent out way before the 5 minutes. Any other thing I should try ?

giuliano