Crazy alert

[christinmb]

Hello, I'm monitoring my PercentFreeSpace in some of my servers so I configurated an alert when the PercentFreeSpace<15 with Time range of 15m and running every minute the search, the problem comes when I want to verify the alert results: I GET 0 EVENTS MATCHING MY SEARCH!

Any idea why this is happening?
Thanks in advanced

[sdaniels · Accepted solution]

That could just mean that you don't have any servers with PercentFreeSpace less than 15%. We would expect no results to show up in that case. Why don't you try it as a search and adjust the number and see if indeed the alert should be bringing back something. If you edit your original question with the search, that would help as well.

[sdaniels]

I think it might be sending you the results 'always' even though it's not a match, and essentially alerting every time that search runs.

[christinmb]

Ok, i'll try that, but why do i get an alert if the condition doesnt meets?

[sdaniels]

Try changing the alert condition from 'always' to 'if number of events' greater than 0.

[christinmb]

http://img543.imageshack.us/img543/7492/configuracindealerta.jpg

[sdaniels]

You didn't say in your question that you were getting the alerts so didn't realize that. Can you post the search details.

[christinmb]

But why am I getting tons of alerts if the results doesnt match?

[emiller42]

Can you provide sample events and the actual search you're running?