Thats an open ended question... what is the alert definition?
We have all of our alerts set to every one minute. The problem is the I think we may be maxing our the system. What would be the best practice for this setting?
My thought would be that two factors will determine what this setting needs to be. First, the specifics of your Orion server hardware setup. The more frequent alerts are posted, the more demands on I/O resources and the faster your database will grow. Can you handle that? Maybe maybe not.
The second factor would be the criticality of the alerts. Perhaps there are alerts that are so critical that you need them set to one minute. On the other hand, other alerts may be deemed less critical and can be set to five minutes, or one hour, or 12 hours, etc.
Can anyone think of other factors?
If the alert engine is unable to keep up with the number of nodes and interfaces you are checking then I would keep only the critical alerts set to one minute and set the rest to five minutes.
It is really up to each organization to define what alerts are ciritical for them.