Rate Limit Throttle Message Disable
"If the number of alerts delivered to the chain’s initial stage exceeds the rate limit, then a throttle message is sent to the individuals assigned to that stage. The message states that the number...
Forum Discussion
I was actually just reading that warning in LM. It sounds like I should leave the Host Status at 6min, which means I should focus on editing the other alerts to wait at least 6min before triggering a ticket.
20 minutes ago, Michael Rodrigues said:You can't change the Host Dead time, it's hardcoded backend logic. You can change the Host Status alert but I don't recommend it, as it doesn't change the back end logic for host death and suppression.
The only magic is the heartbeat interval on the HostStatus DS. It doesn't get reset by every collection type, for example SCRIPT modules will not reset it. Ping will. The backend looks at this value to determine host death and suppression.
It is good to note that changing the idleinterval in Host Status doesn't sound like it will actually mark the device dead sooner since other backend logic is at work. I will be sure to leave it alone. I will look into editing the other alerts with this in mind.
Is Host Status the best metric to base down tickets off of; and ping with alert intervals that wait about 4 intervals (ping is set to 2min by default) so about 8min past before declaring a degrade and making a degrade ticket? Is there a better metric to use for down and degraded site tickets?
