When AirWave is determining whether to send an alert in one email or whether to consolidate many alerts into one email, it considers a few things including whether the most recent alerts were of the same type (ie device down, new rogue, etc). In the case where the APs go down and then came back up within an AMP poll period, AMP marks them down because their uptime had changed and then instantly marks them up again. As the alert engine processes the alerts, they are occur in an order like this:
- Device 1 Down
- Device 1 Up
- Device 2 Down
- Device 2 Up
Since each sequential alert is a different type, emails are sent out individually rather than consolidated.