Alert cleanup - node down and high packet loss

Generally I don't trust a packet loss alert unless it has the timer set to at least 3 minutes (2 minutes for the polling and some time to get the node switched to down status) and the node hasn't been marked down.  No other way about it because all nodes will trigger a packet loss on their way down if you don't put that timer on there.  You either get duplicate alerts or you wait.

Agreed. Personally I always edit the Packet Loss alert to include a rule of Node must be Up as well as a slight time increase. Otherwise for each Node down you will get a packet loss alert, which is a false alert. I always see this alert as a precursor to high traffic utilisation so you don’t want to confuse it with Node down or unreachable.

We deal with the high packet loss alert in exactly the way you suggest - we add a condition that says node must be up

But how do you deal with the alert when the node is actually up? For example, we are getting high packet alerts in the minutes after a node comes back online. In this case, the alert trigger condition is now TRUE and we get 80%,70%,60% etc packet loss warnings

So currently at our site I have added in both mesverrum​ and @david smith recommendations as well as one other check

I have my alerts scoped to include only nodes that the status is not equal to down and the system up time is greater than 600 seconds.

Then i have the alert trigger condition for our site being the percent loss is greater than 40%

Finally the condition has to exist for 5 Minutes as well.

This seems to have cleared up most false positives, including in the scope limitation that the node has to be up for 5 min seems to cut down on the alerts that trigger right after a node reboots.

Glad you got it working as required. Good job.

Still seeing a high packet loss alert immediately after a device reboots, despite configuring exactly as you have done above

Status equals UP
System uptime is greater than 900 (assume this is seconds?)
% loss is greater than 40%
Condition exists for 5 minutes

Here's a screen cap of my trigger.  Just a note we have our email alerts go to a different group depending on if its a windows server or a switch/router.  Just so you know the reason for the "is server" logic in my trigger.  This still inst full proof but it cleans up a lot of the junk.  You also might make the condition exist longer.