I have been playing around with reports and alerts trying to find the best way to report or alert on something that can happen normally which are interface errors or discards. Setting an alert or report for it simply buys you a point in time count. IE alert if errors today went above N or put in a report all interfaces that encountered alerts this month above a total of X.
What logic I think would be handy would be this.
Alert if interface has seen X errors per day this many times per month/week/hour/etc. IE it went above the perdefined limit more than X times in a Y amount of time.
I use errors as an example but I could see that apply to many things like interfaces going down or ultimately any item we track.
