Resolution:
That is not what the "Wait at least xx min after first evaluation" feature is used for.
Foglight rules send out one, and only one email while a particular condition is true.
The only way another email is send out, is if the condition is cleared (ie the issue is resolved
and comes back, or moves to a different severity level).
The "Wait at least (15) min after first evaluation" is used after an agent is first set up and you
want to wait "x" number of minutes before the rule evaluates against it.
For more details on this option, please review the
Administration and Configuration Guide for details on this option.
==> Wait at least [hh:mm:ss] hh:mm:ss after first evaluation. Sometimes when evaluations are performed immediately after a topology object creation, or the Foglight Management Server re-start, a number of false positives can occur. There might be a startup-time factor or the monitored entity simply needs to calm down for a minute or two, before reliable analysis can be performed. This option specifies that the first evaluation and all evaluations in the given time frame afterwards are ignored before evaluation results are considered.
Setting this option causes the rule’s actions (simple and multiple-severity rules) and alarms (multiple-severity rules only) to execute after the specified period.
Example: When a new host becomes available online, a high network utilization is expected, while updates are downloaded or application synchronization commences. To avoid having newly-discovered hosts generate alarms on their bandwidth usage, you can specify a time window, for example, 15 minutes, during which the rule evaluating the network conditions is on hold.
If the rule is multi severity, you may be able to use the following KB article to put a simple rule in
place that will continue to send out alerts if the condition is true (after the multi severity is promoted
to the highest severity).
-
SOL60483 How do I generate a simple rule that will constantly fire repeat alerts for the original rule that
has already promoted to the highest severity?