3 ms·I'd personally base the alert on the syslog message as it comes in but YMMVby ta1243 3y agoI'd personally base the alert on the syslog message as it comes in but YMMV