# Alert Configuration Question

**URL:** <https://community.netdata.cloud/t/alert-configuration-question/124>\
**Category:** Help\
**Tags:** agent\
**Created:** [September 2, 2020, 3:59am UTC](https://community.netdata.cloud/t/alert-configuration-question/124 "2020-09-02T03:59:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pleung2](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@pleung2](https://community.netdata.cloud/u/pleung2)\
**Post date:** [September 2, 2020, 3:59am UTC](https://community.netdata.cloud/t/alert-configuration-question/124/1 "2020-09-02T03:59:17Z")

</div>

I used the following trying to capture an app (Spectre) running over 290 percents for the last 10 minutes. The email alert works fine if a job running CPU over 290% CONSTANTLY for 10 minutes or longer. However, I have another email alert with another job running CPU over 1200% for a little bit over 2.5 minutes. Mathematically, both email alerts seem working fine but the latter one isn’t the one I expect.

How do I configure to capture the app running over 290 percents for full 10 minutes. In other words, it triggers when all captured metrics for Spectre must be equal or greater than 290%. Using “average” in lookup does not work for me when there are spikes occurred.

Thanks!

alarm: apps\_cpu\_Spectre  
on: apps.cpu  
os: linux  
hosts: \*  
lookup: average -10m unaligned of Spectre  
unit: %  
every: 1m  
warn: $this \> (($status \>= $WARNING) ? (280) : (290))  
crit: $this \> (($status == $CRITICAL) ? (290) : (390))  
delay: down 15m multiplier 1.5 max 1h  
to: sysadmin

---

<div class="post-metadata">

**Author:** ![OdysLam](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/odyslam/32/98_2.png) [@OdysLam](https://community.netdata.cloud/u/OdysLam)\
**Post date:** [September 7, 2020, 1:23pm UTC](https://community.netdata.cloud/t/alert-configuration-question/124/2 "2020-09-07T13:23:46Z")

</div>

Cool, thank you for letting us know!

---

<div class="post-metadata">

**Author:** ![pleung2](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@pleung2](https://community.netdata.cloud/u/pleung2)\
**Post date:** [September 4, 2020, 2:45pm UTC](https://community.netdata.cloud/t/alert-configuration-question/124/3 "2020-09-04T14:45:51Z")

</div>

Update:

I just replaced “average” with “min” in the above example and the alert worked as expected.

Thanks!

---

<div class="post-metadata">

**Author:** ![pleung2](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@pleung2](https://community.netdata.cloud/u/pleung2)\
**Post date:** [September 3, 2020, 1:33am UTC](https://community.netdata.cloud/t/alert-configuration-question/124/4 "2020-09-03T01:33:50Z")

</div>

Thank you for the reply. But how do I use “min”? AFAIK, if I have the line like the following:

lookup: min -10m unaligned of Spectre

a single value will be return to $this variable. Am I able to query/access the dataset from the last 10 minutes from that health configuration file and then post process the dataset?

Thanks.

---

<div class="post-metadata">

**Author:** ![zack](https://avatars.discourse-cdn.com/v4/letter/z/f6c823/32.png) [@zack](https://community.netdata.cloud/u/zack)\
**Post date:** [September 3, 2020, 12:59am UTC](https://community.netdata.cloud/t/alert-configuration-question/124/5 "2020-09-03T00:59:09Z")

</div>

You may have to use a more complex [expression](https://learn.netdata.cloud/docs/agent/health/reference#expressions)

For example, instead of average, you might also want to use min.