Even with 1 minute though i don’t get a new alert, do you have an example?
I tested this for a good few hours today with no luck. Running the SQL on the database works fine and brings the correct result.
SELECT syslog.timestamp,syslog.msg FROM devices,syslog WHERE (devices.device_id=152) AND syslog.msg LIKE "%changed state to down%" AND syslog.timestamp >= (DATE_SUB(NOW(),INTERVAL 1 MINUTE))
I have a feeling it’s related to Kevin’s reply in this thread Email immediately on recept of syslog messages configured in alert I think that means that the alert rule will only run on polling.php and even applies to syslog. I know a workaround would be to have 1 minute snmp polling on all my devices, but unfortunately not possible in my setup.