Is there a [non-messy] way to set a DURATION rule for a specific host alert? Basically, what I'm thinking of is something like this:
In hobbit-clients.cfg HOST=myhost LOAD 20 30 DURATION>5m
The effect being, the status of the "myhost" cpu alert will only change to yellow/red if the load is above the appropriate threshold for more than 5 minutes.
There are a few hosts that occasionally will spike above the cpu load thresholds, but only for a few minutes (usually around 5 min at most), and then recover on its own. However, I don't want to raise the thresholds, because a sustained load (more than 10 minutes) at this level _is_ actually a critical event. It's just not critical if it is just a momentary spike.
My specific example is with cpu load, but it could be for other things too, such as process counts, memory, or even in some situations, disk space.