Confused with THold behavior and notifications

[jazzplr]

If I understand correctly, when a breach duration is set to "Never" an alert will be triggered as soon as the poller runs if the threshold is exceeded. I am monitoring logged in users on the local host so I can tell if someone in my department is connecting via SSH to Cacti. If I set the breach duration to Never, an alert gets triggered sometime in the 5 minutes that it takes the poller to run but I do not receive an email. If I set the breach duration to 5 minutes, I get an email. Is this behavior normal?

[noname]

If I understand correctly, when a breach duration is set to "Never" an alert will be triggered as soon as the poller runs if the threshold is exceeded.

I also think so in the past, but it seems not correct.

On current thold (v0.4.9-3), in the following 2 cases, alerting mail will be sent at the first breached when polling.
A) Breach Duration = "5 Minutes" and Re-Alert Cycle = "Never"
B) Breach Duration = "Never" and Re-Alert Cycle = "Every 5 Minutes"

Subject of alerting mail is
A) "ALERT: xxxx went above threshold .."
B) "ALERT: xxxx is still above threshold .." (It shows "still", but it's the first mail)

If both 'Breach Duration' and 'Re-Alert Cycle' are "Never", the threshold is turned to red in thold list but alerting mail isn't sent.

Probably it depends this part in 'thold_functions.php':

Code: Select all

function thold_check_threshold (...) {
			...

			$item['thold_fail_count']++;
			$item['thold_alert'] = ($breach_up ? STAT_HI : STAT_LO);

			/* Re-Alert? */
			$ra = ($item['thold_fail_count'] > $trigger && $item['repeat_alert'] != 0 && $item['thold_fail_count'] % $item['repeat_alert'] == 0);

			if ($item['thold_fail_count'] == $trigger || $ra) {
			        $notify = true;
			}

			...

('$trigger' is determined by thold_fail_trigger. It is "0" when you set "Never")


Developers,

how about this conditional statement instead of the original code?

if (($ra == 0 && $item['thold_fail_count'] >= $trigger) || $ra) {