Windows Performance Monitor “Sample interval” vs. Alert interval

performance-monitoringscheduled-taskwindows-server-2012

I want to get an alert via email whenever available memory drops below a certain threshold on my Windows Server 2012

To do this, I'm using a User-Defined Performance Monitor Data Collector Set. I've configured a Data Collector with a performance counter and alert criteria. I've set up the Alert Task (and the task is set up in Task Scheduler). All that works fine, and I am getting the alerts by email.

My question is about the Data Collector sample interval. I've set that up at, say 60 seconds, because I want to check for low memory every minute. BUT, I don't want an alert every 60 seconds (I rather have one every 15 minutes.)

Is there any way to have an alert interval that different from the sample interval?

Best Answer

I would set up the Action of the task to "Start a Program" instead of "Send an e-mail". The program to start would be a Powershell script that does this: check the time of the last alert sent, and if the last alert was more than 15 minutes ago, send a new alert using Send-MailMessage and update the last alert time. You can store the last alert time in a helper file next to the script or somewhere else.

Example script:

$timeFile = "[PATH TO TIME FILE]"
$needNewAlert = true

if (Test-Path $timeFile -PathType Leaf) {
    $starttime = [datetime](Get-Content $timeFile)
    $timespan = New-TimeSpan -Start $starttime -End (Get-Date -Format u)
    if ($timespan.TotalMinutes -lt 15.0) {
        $needNewAlert = false
    }
}

if ($needNewAlert) {
    Send-MailMessage -From server@example.com -To me@example.com -Subject "I'm in too deep!"
    Get-Date -Format u > $timeFile
}

As an aside: you can further reduce the number of alert emails from a given system by using one script for multiple triggers by passing arguments/flags into the script to indicate the source of the issue. You'll have to keep track of the last alert time on a per issue basis (one way to do this are to keep the source/timestamp pairs in a dictionary/hash table and save the object to a file using Export-CliXML and load the object with Import-CliXML), then you can have the body of the email be a summary of all current issues reported in this manner.

Related Topic