Here’s an example of one of our last received alerts.
{VALUE lastr} {SOURCE {intelus_p01_in idx_bor_in}} {MODE actual} {WITH -2} {COMP {> 10800}} {FOR {nmin 5}} {WINDOW {* * 8-18 * * 1-5}} {HOST {}} {ACTION {{exec {vm_alert.script “%A”}}}}
It watches two threads and triggers if we haven’t received anything in 3 hours and stays true for 5 minutes. It works flawlessly. (In fact too flawlessly this past Memorial day)
The other thing you might want to check is the hcimonitord.log to see if it errored while loading at the top of the log. And then also see if there were any problems around the time it was supposed to fire.
Hope this helps,
-mh
