Alerts which immediately trigger with no delay can cause noise when a condition momentarily flaps or a one-off occurrence self-heals before a user even sees an alert.
In addition to an alert definition’s trigger condition, users can use the Alert Delay setting to introduce certain timing elements which will cause an alert to not trigger until the timing element has been fulfilled.
Time Delay
The Time Delay setting defines how long Auvik waits after the trigger condition has been met before creating an alert and sending a notification.
- Once the trigger condition is met, Auvik starts a timer.
- If the condition returns to normal before the timer expires, the alert is not created, no notification is sent, and the timer resets.
- If the condition persists through the time delay, the alert is created and the notification is sent.
For example, let’s say you have some interfaces you want to monitor for packet discards. Interfaces sometimes have a heavy load and packet discards can spike; but it isn't a problem until a packet discard is greater than 100,000 and stays that way for at least 5 minutes. When creating a packet discard alert with a condition threshold of >= 100,000, simply specify a 5 minute time delay value.
Percentage of Occurrences Delay
The Percentage Occurrence Delay setting specifies how frequently a condition must be true—expressed as a percentage of polls—within a specified time window, before an alert is triggered. This should primarily only be used for ping based alerts that poll at a specific interval. All other alerts will yield inconsistent results.
- The condition must be true for at least X% of polls during the specified time window.
- The condition does not have to be true for consecutive polls.
- Once the occurrence percentage threshold is reached within the time window, the alert is triggered.
A minimum of 2 minutes should be used for the specified time window (minute time period).
For example, let’s say you have some interfaces you want to monitor packet discards. Interfaces sometimes have a heavy load and packet discards can spike; but it isn't a problem until the packet discard on the interface spikes over 100,000 packets at least 75% of the time over 15 minutes. When creating a packet discard alert with a condition threshold of >= 100,000 packets, simply specify 75% of occurrences during a 15 minute period.
Number of Occurrences Delay
The Number of Occurrences Delay setting allows you to trigger an alert only after a condition occurs a specified number of times within a defined time window. This option is useful when occasional or infrequent occurrences are expected and normal, but repeated occurrences within a short period indicate a potential issue.
Number of occurrences delay complements the existing percentage-based occurrence delay by enabling alerting based on absolute frequency, rather than the proportion of polls where a condition is met.
- The condition must occur at least X times within the specified time window.
- The occurrences do not need to be consecutive.