Alert is firing, but sent data looks OK

Question

I set an alert condition for an IP. The condition is to send an alert when there are 3 incidents over 2000ms in the last 6 pings. The max e-mail frequency is 30 minutes, and the duration to wait for worse condition is zero. However, I sometimes received alerts in which the most recent 6 pings, as shown in the alert e-mail, are below the threshold. What did I do wrong to create these false alerts?

Solution

Check to make sure that your 'Maximum samples to hold in memory' isn't set too low. The setup in this case had e-mails going out at maximum every 30 minutes. The 'Max samples in memory' was actually set to only hold about 25 minutes worth of data at a time, so sometimes the alert would go out based on conditions that had already dropped out of memory.

To fix this problem, just change the 'Max samples to hold in memory' to hold at least the amount of time your maximum e-mail frequency is, preferably a bit more (as the history files that can be included in the e-mails can actually show more data than this).

To change this setting, access the Auto-Save option screen in Edit -> Options.