Macro keeps alerting even when memory / filesystem returned to normal values

The following macro [alerting_filesystem_usage] is used to alert for filesystem issues.
the timerange of the search is 60 minutes for the savedsearch.
file/line octamis / metricator-for-nmon / metricator-for-nmon / default / macros.conf — Bitbucket

When we have resolved the filesystem issue, it keeps on triggering every 5 minutes until the values shift out of the 60 minute alerting window.

The alert keeps looking at the complete timerange of 60 minutes instead of looking only at the last alert_fs_min_time_seconds seconds, which contains the most recent filesystem metrics.

Propose to only look at the last “alert_fs_min_time_seconds” by adding this into a where clause.
the + 300 is used as a save margin to don’t miss any alerts.
| where _time > now() - (alert_fs_min_time_seconds + 300)

Same holds for memory alerts, I can make a PR for this if you like, but would first like to have a discussion about this in this ticket.

‌

Comments (1)