If an alert is scheduled for every 30 minutes to look back 30 minutes, does it search since the last report's idea of what "now" was, or does it just do current "now" minus 30 minutes?
The reason I ask is to know if alert conditions can be missed if they occur JUST AFTER a previous report was run, and CPU utilization or other situation delays the next report from running by a few seconds. If the report just goes back 30 minutes from then execution of the scheduled search, these just-after events would be missed.
Must I take precautions such as looking back 35 minutes for a 30 minute period? What is the behavior for alert conditions that are found in two consecutive scheduled searches?
Thanks!
... View more