recently, we had a problem with a toggling LACP group and as a result a bigger network outage.
We currently collect all the switch logs inside Netsight/EMC.
Now I would like to create an alarm, which detects toggling LACP links, so the events LACP.RemPortFromAggr and LACP.AddPortToAggr would be interesting.
But I don't want to receive alarms, if this happens only 2 times per minute - if someone restarts a server, I don't want to get an alarm.
Is there a solution to create a log-alert including a threshold?
Would be interesting for other logs as well, e.g. port up/down with > 10 times per minute...