What is the best way to ensure alerts fire only after sustained high usage?

What is the best way to ensure alerts fire only after sustained high usage?

• A. Configure the alert to trigger only when traffic utilization is sustained for 10 minutes
• B. Set the alert to trigger on any single spike
• C. Increase the alert threshold to the maximum
• D. Disable the alert and rely on logs

Answer: (A)

The main idea is to avoid alerting on short-lived fluctuations by requiring the condition to remain true for a period before firing. By configuring the alert to trigger only when traffic utilization stays above the threshold for a sustained duration (like 10 minutes), you filter out brief spikes and normal blips, so you’re alerted only when there’s genuine, sustained high usage that could impact performance. This helps reduce noise and prevents desensitization to alerts. Triggering on a single spike would produce many false positives from momentary bursts or jitter. Increasing the threshold to the maximum makes an alert unlikely to fire at all, so a real issue could go unnoticed. Relying on logs and disabling the alert removes proactive notification entirely and delays awareness until you review logs, which is not effective for timely response.

The main idea is to avoid alerting on short-lived fluctuations by requiring the condition to remain true for a period before firing. By configuring the alert to trigger only when traffic utilization stays above the threshold for a sustained duration (like 10 minutes), you filter out brief spikes and normal blips, so you’re alerted only when there’s genuine, sustained high usage that could impact performance. This helps reduce noise and prevents desensitization to alerts.

Triggering on a single spike would produce many false positives from momentary bursts or jitter. Increasing the threshold to the maximum makes an alert unlikely to fire at all, so a real issue could go unnoticed. Relying on logs and disabling the alert removes proactive notification entirely and delays awareness until you review logs, which is not effective for timely response.