Complex alert times

damasneto

Hi guys.

Sometimes we have to create a complex alert like the example below:

If an interface goes above 90% of utilization for 10 minutes, then it goes under 90% for 5 minutes, then above 90% for another 10 minutes, then under 90% for 5 minutes......

If I create an alert for interface utilization above 90% for more than 15minutes, it will never trigger, since every time it goes under 90% the time resets.

What I`d like to see in Alert Manager is an option to SUM the time it goes above threshold of a specific amount of time to actually trigger the alert.

Let`s say if an interface utilization goes above 90% for 20 minutes inside a period of 1 hour, that would trigger the alert.

What do you say about this?

Thanks..

damasneto

Another great improve would be: Deviation of x% above/below the mean of Y minutes/hours/days passed.

Example:

Let`s say a device usually consumes 20% of bandwidth available every monday from 9am to 10am. Next monday, at the same time, the bandwidth consumed was 40% (or 100% above the normal usage); Something happened in that case, and it should trigger an alert.

What do you think about that?