Cooldown delay for alerts

Hey all i got a (not realy) “bug” or so:

i have 2 Macro’s, they calculate % use of the xDSL use - yust like normal ports:

$config['alert']['macros']['rule']['dsl_in_usage_perc'] = '((%ports.ifInOctets_rate*8) / %ports_adsl.adslAtucChanCurrTxRate)*100';
$config['alert']['macros']['rule']['dsl_out_usage_perc'] = '((%ports.ifOutOctets_rate*8) / %ports_adsl.adslAturChanCurrTxRate)*100';

So my alert is set up:
if in is more then 85% use OR out is more then 85% for more then 3 mins then mail “TiTaTel”
match on group xDSL ( This is an dynamic group )

Mail Trasnport TiTaTel = transport mail, not default
Group = Dynamic, named xDSL, ports.ifDescr LIKE '%dsl%'

So, what happening:

Lets grab the port whit it:

I got mail hit on 12:12:
So 12:07 Alert / wait 3 mins = 12:10 … so how 12:12 … i dont know ( 5 min??)
while on 12:11 clear is and 12:12 again an alert is

> Timestamp: 2020-04-20 12:07:11
> Rule: xDSL utilisation over threshold
> 
> |Physical Interface:|VDSL|
> | --- | --- |
> |Interface Description:|VDSL|
> |Inbound Speed:|47.26|
> |Inbound Utilization:|6.92|
> |Outbound Speed:|7.90|
> |Outbound Utilization:|6.96|

Next mail i got is Recovery on 12:23 (again 12:18 + 5 min???):

> Time elapsed: 2m 59s
> Timestamp: 2020-04-20 12:18:11
> Rule: xDSL utilisation over threshold
> 
> |Physical Interface:|VDSL|
> | --- | --- |
> |Interface Description:|VDSL|
> |Inbound Speed:|47.26|
> |Inbound Utilization:|7.33|
> |Outbound Speed:|7.90|
> |Outbound Utilization:|6.99|

SO my stamp is from 12:18 what is the clear state
whit an time elapsed from 3 mins ago what is indeed the 12:15

But where are the mails in between, why they are cleared and recreated after 1 min…
so is it broke the mail sending?

looking more closer:

85% of 7.90 = 6,715‬

Zooming in to the 12:10 - 12:11

So its cleared. its correct, but no mail. and on 12:12

so … its triggerd again.

So yes i could set my 85% to 80% for example.
But maybe is it posable to:

Respect an cooldown delay for clearing the alert?

like here:afbeelding
So Delay would be Start Delay (now 3m) and a new window whit Clear Delay (now 0m)
So u can use this for the BW utilisation.

And why do i get an recovery on 12:23 of the clear…
(i think i know bc the betweens is not 3min delay…)

Thats a lot of info :laughing:

Whats your poller interval?

1 min :slight_smile: :slight_smile:

I think someone with better knowledge of the alerts flow should answer this…