Help needed on setting alert triggering on CPU & memory utilization

I did not make changes to the default polling time, I guess it's every 120 seconds.

How do I view the RAW data from performance analyzer?

There's no reset action for my alerts currently, due to the volume of email being sending out creating reset action email will cause even more email triggering. I will configure a reset action once everything is stablized.

The RAW data also shows that the same problem.

CPU utilization was 100% at 10:29AM then 10:31AM I receive an email of CPU 100% alert, which is not true because at that time the CPU has already went down. Any idea how I can fix this? 

have exactly the same issue, alert is catching short CPU spikes only and triggering alert!!! "Condition must exist " time does not work, please help!

Not sure if you've managed to get this sorted. Your issue is that you need to increase the polling frequency for this node (or all nodes) to less than the condional check.

So if you want to trigger the alert after 2 minutes, you need to poll every 1 minute to be able to have a chance to caputre the data.

It's also worth considering that the polling capture is a single point in time for the polling interval. So lets say you poll the server at 13:00 and the CPU is 40%, and you have your polling interval set to 1 minute. If the CPU rises to 100% up till 13:00:59 and then drops back to 40% you will never capture the event.

I have our system tuned down to 90 seconds for everything and it's ok. Turning down the polling interval results in higer load so check your polling engines inder the settings to see the utilisation before and after to see the impact you have on the polling sucess.

I would also add for reference the various time intervals and configurations in place to be aware of. It is a delicate balance to get them right. What you need to be focused on is how often item 2 below is checking for new data, how often item 3 will check the database for the trigger condition and how long item 4 is set to delay that condition before triggering an alert. Appropriately setting them all for your environment makes for good alerting.

Also take into account any possible delay in the SMTP mail process. But note that you’re talking about a few minutes. It depends on your environment ultimately but server resources can spike regularly and I would more concerned if those resources exceeded my thresholds for longer than 2m, maybe 5m+? That seems extreme to alert on but that’s just my 2 cents.

Try looking into the enhanced thresholds. That really avoids some of the timing issues and you could alert on cpu/mem specifically crossing a threshold - e.g. 5 consecutive polls > 90%. If statistics collections runs every 1m then that’s a sustained 5m sampling of 90%+ utilization.

documentation.solarwinds.com/.../core-orion-thresholds-sw1775.htm

1. Polling interval (this is the generic up/down status etc.)
2. Statistics collection interval (this is the cpu/mem polling)
3. Alert check interval (this is how often your alert checks the database for any trigger conditions)
4. Alert Condition must exist for x time (this is essentially adding delay to the trigger)

Hope this info helps and good luck!