Has anyone seen this behavior: An recovery alert is issued (see screenshot), and the additional “false” alerts are issued a few hours later. I can confirm (see screenshot of graph) that the SWAP usage has not increased past the alert threshold.
I’ve marked the times in the graph to show that a recovery alert was issued, and then four false alerts were issued.
Does anyone have any tips on how to debug this?