I created a report to show events that occur repeatedly. It can be tweaked as needed but in this case I am looking at the last 7 days and any event that has occurred more than 5 times. I am filtering out several event types for normal events such as node up (otherwise you may have a node show 5 times down and 5 times up)
One thing to note to make the report work better is I changed some of the event messages that occur specifically those for response time and utilization. The problem I was facing was I would have an event message that said an interfaces utilization was currently 85% and the threshold was 75%. If I didn't alter the event message I would require 5 seperate instances where the utilization was exactly 85%
The changes in the event messages are not done in the report but are done in the actual alert actions.
