From "up" to anything
In this example, the alert arms when conn_1 transitions from "up" to any other state. A state transition that is from any other state in addition to "up" does not arm the alert. If it stays in that destination state for 30 seconds, then the alert fires.
- Alert Name: EX9
- Alert Type: protocol status
- Source: conn_1
- State From: up
- Source Count: all
- Comparing: diff
- Duration: N seconds and 30
- Action type: notify