Are you just looking for a count - ie
NodeName Number of times over 90%
or a detailed report showing the date a time the breach occured as a list?
Here is what I did for this although I'm certain there are multiple ways to tackle. I wrote an alert every time circuit utilization exceeded X% for 30 minutes. Then I wrote an NPM event that gave the following text RouterName Interface name currently has a bandwidth over X%. I set this action to trigger every thirty minutes that the alert was active. I then wrote a report that tallied up those event messages (I intentionally left of the actual percentage used so that I could tally like messages. Would be very difficult to find like messages when I had one say 95% and one say 94% etc).
I then have current day, 7 day, and 30 day copies of that report.
Stuart, I am looking for a detailed report showign date and time of each occurance.
Mike, I'll look into that.