We have this problem frequently, so I'll bring up a recent example to demonstrate.
We had some host swapping recently. We have the default thresholds of 64 and 128mb for warning and critical. We have two VM's that still have some virtual memory in vswp after the swapping occurred. We get alerts every 60 minutes (our frequency of alerts) for each vm stating that the virtual memory has been swapped, and for each host running these vm's that there is host swap. I have went and clicked resolve on the alert of the affected entities, which I thought would make it not alert until the resolved alert was cleared (either manually by hitting "clear", or by the swap going away after a reboot of the vm's) and this condition happened again.
I see my option being change the alerting levels and the threshold to accommodate this. The problem with it is, right now the amount of swap is around 1.2gb. If I set the alert level to 1gb and the threshold to 50% this wold work to stop the repeated alerts, but next time, what if it swaps 3 gb. I would have to keep changing the alerting levels rather than having an "acknowledge" button that says "yes, i know about this, don't alert on it anymore until it drops below the warning threshold/self corrects".
Is there a way to not get repeated emails on a critical alert until it drops warning, then receive one alert/notification that it has dropped to warning with no more alerts while it is in warning unless it goes back to critical, or if it goes to normal?
Does the resolve button have anything to do with receiving repeated alerts? What is this used for other than a visual stating that problems have been taken care of, anything to do with alerting?