Can't find what you're looking for? Access our previous PDF-based library.
3 min read
️ Updated Jul 24, 2026Lepide Alerts Sending Inconsistently - Thresholds Set Too High
Issue Summary
Lepide alerts are sending inconsistently — sometimes alert emails arrive as expected, and other times they do not, even when the relevant activity is happening in the environment. The alert configuration appears correct and the email delivery profile is working. Restarting services does not resolve the issue. An occasional server reboot may temporarily restore alerts, but they stop again shortly after.
Observation
Customer reported that alerts were arriving sometimes but not consistently — for example, a few brute force or mass copy alerts would come in during the morning but then stop for the rest of the day despite continued activity in the environment. This pattern is the key indicator that the issue is threshold-related and not an email delivery or connectivity failure.
If alerts were completely broken, no emails would arrive at all. The inconsistent pattern, where some were arriving but most not, almost always points to alert thresholds being set too high for the actual activity volume in the environment.
Root Cause
Each Lepide alert has a configured threshold — for example, 'trigger alert if X events happen within Y minutes'. If this threshold is set too high, the alert will only fire on rare occasions when that exact volume of events occurs in the defined time window. For most normal activity periods, the threshold is never reached, so no alert is sent.
In this case, the Mass Delete Behavior alert threshold had been changed to 2000 events in 3 minutes which is an extremely high value that would almost never be reached in normal usage. This meant the alert was technically working but only firing in rare circumstances, giving the impression that alerts were unreliable or broken.
How to Troubleshoot
In the Lepide console, go to Change Alerts
Click the pencil/edit icon on the affected alert
Check the threshold values — note the number of events and the time window configured
Compare the threshold against realistic activity levels in the environment. For example, a Mass Delete threshold of 2000 events in 3 minutes would require 2000 files to be deleted in 3 minutes which is unlikely in most environments
If the threshold is unrealistically high, this is the root cause
As a quick test: set the threshold temporarily to a very low value (e.g. 2 events in 5 minutes) and trigger the activity manually. If an alert email is received, the threshold was the issue and needs to be set to a realistic operational value.
Resolution - Correct the Alert Thresholds
After correcting the thresholds, alerts fire consistently whenever the configured activity threshold is genuinely reached.
Status
Resolved - Correcting the alert thresholds to realistic values restored consistent alert delivery. Test alerts confirmed received immediately after the fix.