To better determine how to set the Duration and Window values for missing critical Events being raised, it is critical to understand what to expect given different configurations. When setting up the rules the following needs to be considered in determining what values should be set.
First we should define the values we are working with.
Example Scenarios assuming items targeted are polling at the default 5 minute poll cycle.
In these examples the first two are considered Consecutive, while the third would be considered cumulative due to how the Event Rule is defined.
The same applies to items polled at a 1 minute poll rate. Since we're evaluating thresholds against each data point loaded, and we load 1 minute polled data points every minute, the rules will evaluate 1 minute poll cycle data.
If we have a profile applied to a mix of items with both 1 and 5 minute poll rates, with Event Rules showing 1 minute Duration and Window values, we evaluate every 1 minute poll cycle data point for violations. Every 5 minutes the 5 minute polled item data points are evaluated along with the 1 minute item data points. In this scenario the 1 minute polled items would raise events against each poll cycle, same as the 5 minute, while both use the lower 1 minute Duration and Window values.
For a clear to be sent, we need to no longer have enough violating data points to meet the duration in the window, and enough data points that meet the clear criteria for the duration within the window.
We are always looking at the number of data points in the window. A new window is not created upon raise or clear.