Sustained CPU & Memory Alerts

You have a few options:

1. Use SAM notification module to control  - set up NCI ( notification configuration item ) and configure the publish delay

( see detailed information in the SAM notification module user guide )

2. If you have watch4net, you can use the w4n alerting module instead of the Smarts IP-AM-PM polling and threshold.

If you are familiar with ASL, you can write a hook script, apparently, this is harder than the above 2 options.

Hubery

I've wrested with this problem for a few years. The fundamental problem is "overtime" alarms are not really supported in the underlying domains.

I would suggest W4N is the easist option here, this is how I am planning to do it.

In the past I have implemented it with a hook script and an escalation policy. When the event first notifies you put a tag in a UDF and build your filter view to hide events with that tag. You then configure an escalation policy with a level 0 that runs for the desired delay (e.g. 45 mins). At level 1 call an auto server tool that removes the tag so the event now appears in the display.

Thanks huberyhe & AlanG for giving suggestion