Thanks a lot for your reply Andreas, but I think I must be missing something in your explanation. Just to clarify, in case it got missed or misunderstood, I only want to throttle alerts for non-business hours. IE: 5pm-9am, and leave the notifications as normal. Your answer sounds a bit like it’s how to throttle for clients tagged as 9-5 all day.
I would modify this a little bit.
Your notification rule should include the tags, the timeperiod and as a new filter “Restrict to n’th to m’th notification”. Now you need to configure that if the host has the tag “daytime_hours” and that there are a rule “Periodic notifications during service problems” is created. If you set this to 10 minutes and you set your notification rule the restrict parameter to “2 - 2” then only a mail after 10minutes is sent.
Pay attention to set the “Restrict to n’th to m’th notification” in other rules to only the first message.
I have created a monitoring configuration rule as for max number of check attempts as follows, setting max checks to 6 if the host has the 9-5 tag and put it just before the default alert rule:
This isn’t what I want though, because that throttles the tagged host at all times, not just during a time period, and I’m not seeing a way to set time period in here. I also notice I don’t have the “Periodic notifications during service problems” as you have to let me set the periodic notifications setting - I’m running 1.6.0p14.
I have also created a notification rule as a copy of the default, with the changes of matching the host tag and it being during the time period, and restricting to the n-th to m-th notification.
It almost seems (now I’m looking at it) that the second part (the new notification rule with n-th-m-th) is all that’s needed, as that will (I think) let me ignore certain notifications. So if I were to set it to 3-9999, that would say “ignore the first and second notification, but send notifications for anything after that.”
Would that accomplish sort of what I want? IE: with just the second part - the notification rule - the system would still do the same number of checks in the same time period, but I could ignore the first 2, so if it does flap on and off over night, I wouldn’t get alerts until it was hard down for more than the first 2 default max check attempts?
I am understanding this right?
Or am I misunderstanding your reply completely 