Hi Everyone,
I have an alert that triggers when a switch port averages >80% utilisation over a 5 minute polling period as below:
However as network traffic tends to fluctuate it can happen sometimes that when a device is legitimately using a lot of bandwidth the reported usage can fluctuate a little above and below 80% each polling period and this results in a lot of alert and alert recovered alerts being sent out.
To avoid this I’d like to add some hysteresis to the threshold - so that the port goes into alert state when the usage goes above 80%, but does not clear alert state until usage drops below 50%.
However I can’t see any obvious way to define different thresholds for setting and clearing alerts. Can anyone suggest a way to do this ?
If there is a property I can check within the alert rules that indicates whether the alert is already active or not, I might be able to do it with some nested and/or logic (different threshold depending on whether the alert is already active) but I don’t know if there is such a property that I can check, and whether that property updates before or after the rule checks are done.