Alert email data problems

Question

I sometimes get alerts where the emailed data makes it seem like the alert shouldn't have fired. Why am I getting false alerts?

Solution

Check to make sure that your "Maximum samples to hold in memory" isn't set too low. If your setup has e-mails waiting before they are sent (ie: wait for 30 minutes before sending, or don't send email more than once every 30 minutes), then some of the data that caused the alert may have already been dropped from memory. The "Max samples in memory" controls how much data is held in memory, and if your alert waits 30 minutes but you only have 20 minutes of data in memory, then the alert would go out based on conditions that had already dropped out of memory.

To fix this problem, just change the "Max samples to hold in memory" to hold at least the amount of time your maximum e-mail frequency is, preferably a bit more (as the history files that can be included in the e-mails can actually show more data than this).

To see how to change this setting see our tutorial.