Alert Trigger on Alert count

Question

I am looking to create an alert if there are 3 triggered alerts instances of a specific AlertObjectID in the last 10 mins.

I have working SWQL to give me a count but I seek suggestions on setting the Alert.

Thanks, 
Sean

===========

SELECT Count(Message) as AlertCount FROM Orion.AlertHistory a WHERE EventType=0 AND MINUTEDIFF(TimeStamp, GETDATE()) <=10 AND (a.AlertObjectID = '247821')

ggatten · Answer

Trying to catch flapping conditions right?  Definitely important!  This is especially true when you introduce delays or durations into the triggers.  Ie:, the interface must be down for 2 mins before an alarm.  Imagine a case where it's down 1 min, up 1 min, etc...  You have a service that's basically unusable and you'd never know about it.

monitoringlife · Answer

Groups might be a viable alternative, unless someone smarter comes along and knows if AlertHistory table is in the alert engine.

sredmond · Answer

Thanks for the reply. We are wanting two levels of Alerting. A Warning if the status goes down for 1 min (condition must exist).

We would want a critical alert if there are 3 Alerts on status down in a 10 minute window (ex is the status drops and returns 3 times in 10 minutes.