Greetings.
I have run into a scenario in which recovery alerts are not being generated for “port down” alerts under a certain specific circumstance. I have an alert rule with the following conditions:
macros.device = 1 AND ports.ifOperStatus != “up” AND ports.ignore = 0 AND ports.port_id = 4660
Recovery alerts are configured for the alert. In addition, LibreNMS is configured to receive (all) traps using snmptrapd and the standard LibreNMS trap handler. Alerts are configured to run once per minute.
If port 4660 goes down, the alert will trigger, and an alert notification will be sent during the next alert run. If the port then comes back up, the alert is cleared and a recovery notification is sent during the next alert run. This is as desired.
The situation in which a recovery notification is not sent is this. The port goes down. During the next alert run, the alert is triggered and an alert notification is sent. All’s good to this point. But now, if the port comes up, then goes back down, and finally comes back up a second time in between two alert runs, the alert just quietly clears, and no recovery notification is sent. I can consistently reproduce this behavior.
Shown below are the values of the “state”, “alerted”, and “open” fields for this alert from the alerts table during the events described above:
Port up initially → state=0, alerted=0, open=0
2026-07-29 17:26:04 linkDown trap → state=1, alerted=0, open=1
2026-07-29 17:27:00 alert run → state=1, alerted=1, open=1 alert notification sent
more alert runs
2026-07-29 17:57:00 alert run → state=1, alerted=1, open=1 (still)
2026-07-29 17:57:16 linkUp trap → state=0, alerted=1, open=1
2026-07-29 17:57:26 linkDown trap → state=1, alerted=0, open=1
2026-07-29 17:57:41 linkUp trap → state=0, alerted=0, open=1
2026-07-29 17:58:00 alert run → state=0, alerted=0, open=0 alert cleared with no recovery notification
“alerted” is changed to 0 when the second linkDown trap (the one between the two linkUp traps) is received. The second linkup trap then changes “state” to 0, at which point state=0 and alerted=0. The last alert run (at 2026-07-29 17:58:00) then just clears the alert with no recovery notification. Is that the intended behavior? If Recovery Alerts are enabled for an alert, then it seems like the alert should not be cleared without a recovery notification being sent.
Thanks.