Alert email Incidents suppress period.

To test this I changed the threshold to a very low value and so was expecting the first email and then the second after 150 seconds and then the third email etc.. Did not get any other than the first email (I get this first email each time I modify the threshold). Not a problem with email client as I had added a gmail id also to this to test... 

Hi Jibi,

The issue sounds like your incident is never actually ending. The 150 seconds applies from incident end. If your threshold is set too low, it will never actually end meaning the 150 seconds never gets applied. When you modify the threshold an email sends because technically it's a new incident. If you look at your incident dashlet you can visually see when the incident ends.

I would recommend setting a higher threshold so the incident gets triggered less often (for example every 10-20 seconds). Once the incident ends, you should not receive any new alerts for 150 seconds from the end time.

Tom 

Thanks Tom. I get it now. I had kept the threshold low in purpose to test this. 

Consider the case of a major incident on your site. We get the first email and the incident has not ended. Is there a way to generate another email say after a few minutes. I was just considering of the possibility of someone missing major incident emails.. One thing I can do is may be create another measure and incident and may be change the evaluation time frame etc????  

There is a way to generate additional emails but I would definitely be cautious when using this approach (as I've seen people get spammed with literally tens of thousands of emails). You can put your client into debug mode (Ctrl + Shift + F9 on Windows) and then edit the incident. You'll see an additional "Sensitivity" field which will get you what you want. Actually, this may help with your testing the Incident suppression. You could set your sensitivity to "Per Violation," meaning each transaction that breaks the threshold would immediately end. This would work in the way you initially thought from your first post I believe.

Again, use caution if you use this route since it can cause a large number of emails if set up incorrectly. 

Thanks Tom.