Alerting around an ignore window is intended to provide flexible behavior. The window applies specifically to sensors created during the window that have alerts enabled. Sensors that do not alert do not going into Ignore. The chart below shows 4 typical examples or sensor alert triggering.
- The sensor is created and its trigger delay expires before the ignore window and the sensor continues to exist through some or all of the ignore window.
- The sensor does not go into ignore.
- The alert is triggered(see note) at the end of the trigger delay
- The sensor is created before the ignore window begins and the trigger delay extends into the ignore window.
- Since the condition was created before entering into the ignore window, it is not ignored.
- An example might a connection to a partner that has to be operational until 5:00 PM with a 2 minute trigger delay. If it goes down prematurely at 4:58:03, this could mean lost data and needs to be reviewed.
- The alert is triggered(see note) at the end of the trigger delay even though this is inside of the ignore window
- Since the condition was created before entering into the ignore window, it is not ignored.
- The sensor is created during the ignore window and the condition extends past the ignore window.
- The sensor is ignored during the window
- At the end of the ignore window plus the trigger delay, the alert is triggered(see note)
- Starting the policy while the condition is active will also trigger this scenario
- The sensor is created during the ignore window and the trigger delay expires during the ignore window.
- The sensor is ignored
- No alert is triggered
Note: Alert triggering includes sending notifications, logging and driving actions. Rearm may also occur once triggered based on alert settings. This is represented by the blue dot in the diagram.
The policy logs can be used to view alerting associated with a sensor. For example, the example below shows an example of case 3. The schedule delay shows that about 79 seconds are left in the ignore window, at which time this alert will be triggered (if the condition still exists).