nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Clarification Required on Alert Evaluation Frequency and Sustained Threshold Behavior

Hello Community Members,

I understand that similar questions may have been discussed previously within the community. However, I would like to seek some clarification regarding alert evaluation behavior in our SolarWinds environment and would appreciate your insights.

.Environment Details:

Number of SD-WAN devices: ~300 nodes
Interface Statistics Polling Interval: 5 minutes
Alert Evaluation Frequency: 5 minutes
Threshold: Bandwidth Utilization ≥ 95%
Trigger Sustained Condition: 20 minutes
Reset Sustained Condition: 20 minutes

These SD-WAN devices are designed to operate at consistently high bandwidth utilization, which is generating significant alert noise. We are reviewing our alert configuration and want to understand precisely how the alert engine evaluates sustained threshold conditions. Based on our understanding, if interface statistics are polled every 5 minutes and alert evaluation also occurs every 5 minutes, the timeline would be:

Time	BW Utilization Status
10:00	Normal
10:05	High BW (>95%)
10:10	High BW (>95%)
10:15	High BW (>95%)
10:20	High BW (>95%)
10:25	High BW (>95%)
10:30	High BW (>95%)

My assumption is that the alert would trigger at 10:30, since the threshold has remained breached for more than the configured sustained period (20 minutes) and sufficient polling intervals have occurred.Could you please confirm:

How the Alert Evaluation Frequency interacts with the Interface Statistics Polling Interval when both are set to 5 minutes?
Does SolarWinds evaluate only the latest polled statistic during each alert evaluation cycle, or does it perform any historical lookback?
Based on the example above, at what exact time would the alert be expected to trigger?
Is our understanding of the sustained threshold logic correct?

Appreciate your guidance on this behavior, as we are attempting to optimize alerting and reduce unnecessary bandwidth utilization alerts from these SD-WAN devices.

@KMSigma.SWI @cnorborg

Find more posts tagged with

orion

npm

Accepted answers

All comments

Hi, you are mainly correct. One thing to add though, timing on polling intervall and alert trigger intervall are not aligned.

Meaning that for example, first poll might happen at 10:05 and first alert evaluation at 10:09. Second poll at 10:10 and second alert evaluation at 10:14.

Thank you for the information. I have configured the alert using the same logic described in my post. Will it work as expected, or do I need to modify the alert evaluation frequency to be lower than the polling interval?

If you need it to trigger at or before the half hour happens, I'd suggest moving your "Trigger Sustained Condition" downward a bit? As @Lofstrand said, you can't count on things to be aligned where one happens in the same minute as the other. Maybe move the sustained condition down around 5-10 minutes? Your polling and alert frequency are already faster than normal I think. But, if things aren't aligned, you need to assume that the sustained condition might have been happening for a while before it was seen. If you need that rigid of guidelines, where it has to alert at 30 minutes, not before, and not after, you might find adjusting things to be quite difficult to achieve that.

If I needed it to be that accurate, I might go another direction altogether and try and use Netflow which is much more granular than SNMP polling for bandwidth. Either construct a query that looked at the % utilization for the time periods in question, or calculate the total bytes that would have to go over the interface to achieve that utilization in the timeframe and alert if it goes over that.

Quick Links