Volume alerts acting up. Sending too frequently and not within the defined parameters

jdbvalley

I have two types of volume alerts, one to alert on warning when available space is between 11 and 15%, and one to alert on critical when space is between 0 - 10%. Neither is triggering correctly. They're sending too frequently and the critical alert is sending alert for servers with 11 and 14% available. 

I'm wondering what I'm going wrong here? I only want these alerts to send once every 12 hours unless newly triggered. I've pasted below what the trigger condition is for my critical alert since it's the one sending alerts on volumes with yes, less than 10% available but also with up to 15% of drive space available.  

Also, what should my Evaluation Frequency of Alert be? I have it set to one minute because I want to make sure it picks up any urgent space issues that happen that could arise quickly and cause an outage but I only want repeat alerts on a server every 12 hours. 

Any suggestions? Thank you in advance. 

jm_sysadmin

You didn't include the alert's Trigger actions screen, I assume that you have an escalation after 12 hours to email again? 
The Evaluation Frequency is typically fine at a minute (it runs the query to trigger or close alerts) but you can change it if you don't need alerts to trigger or clear quickly. 

Do the alerts resolve themselves? (you can see it in the alert history, but if you have an Event written to the netperfmon log (I like that for all my alerts) before the escalation you can use that to see how many times as well. With my disk alerts, I have seen many times that disk will 'sawtooth' over and under the threshold. I make sure that my alerts hold above the threshold for 3 polls (I think the default disk stats collect hourly, I set mine to 25 minutes). I also don't clear the alert when the condition isn't met (which I do on almost all of my other alerts) I want it to be under the thresholds for 2 polls. One more thing, if my staff has to clean up/ add more disk, I make them fix it for the warning level (in your case the 15% free) for both warning and critical alerts. That way a second alert when you are coming out of Crit doesn't start a new instance of alert (we tie them to incidents in Service Now, and wouldn't want duplicates)