last update alert

This alert is the same as other existing time alerts. For example, "last receive" and "last send".

This alert checks the last update time of the thread data in shared memory. This can be used to monitor if a thread or engine is hanging, where the process is running but internal operations have halted. Such a condition may stop the normal thread updates of the shared memory data that happen about every five seconds.

The contents and options of this alert are the same as the other existing time alerts. In some ways, this alert overlaps the other time alerts but can be much quicker. The duration requires only 30 seconds to ensure that there is a problem.

In the case of a "zero" last update time (that is, the shared memory has never been updated), the alert is skipped.

Note: This alert fires if the process is dead. To avoid false or duplicate alerts you can combine its state with the process state using an "and" alert.

In CIS 6.0 and earlier versions, the current last receive alert would get the value of "MSI last receive" even though it was disabled. Because the value of the alert had been updated, it was triggered when it was enabled.

This was caused by the alert not resetting on a disable. When it was enabled, it would fire in zero time if the limit was exceeded.

This issue is fixed by having the last sample time of the alert be saved as the last time when disabled more than up to five seconds. This is the MonitorD sample time. When enabled, that time is used for the alert test until the new time in MSI. Other conditions are if the value in MSI was reset or the thread was restarted.

For correct operation of these alerts, this cannot be accomplished from the Alert Configurator GUI.

The Activate/Deactivate options on the Alert Configurator GUI use a different logic from the hcicmd enable/disable commands.

You must use hcicmd to enable/disable the "last update," "last receive," and "last send" alerts.