Minimum frame count threshold for alarms

[lennartkoopmann]

Introduce an optional minimum frame count threshold for alarms that might trigger to early if only a single frame can cause them.

Discussed in #508

^{Originally posted by kruthoff September 2, 2021}
I see false alarms (UNEXPECTED_CHANNEL_BEACON, UNEXPECTED_CHANNEL_PROBERESP) which are based on a single frame. Is it possible to generate alarms only at a higher number of frames? Or doesn't this make sense?

I see false alarms (BEACON_RATE_ANOMALY) for spikes for peaks that occur very rarely.
Is it possible to avoid alarms for such spikes?

[timn]

This would be very useful indeed. My use case is slightly different: the APs will hop channels every now and then to optimize signal. I have a script which runs priodically to retrieve these and if changed updates the nzyme config to the newly expected channels. Now there is a race between the AP changes the channel and the update script being run.

Another way which may be interesting to set is if the problem persists for some minimum duration, e.g., 2 minutes (so it is independent of the number of frames received but means that a problem must persist at least for some specific time).

Yet another option is to externalize the decision by enabling an external program/script to be run ("trigger alert?"). In my case I could query the AP and tell if the channel is expected, for fingerprints one could use a sqlite db to check if a problem already persists for some time. I think this would be very flexible and useful, and at the same time fairly easy to implement.

[lennartkoopmann]

Thank you! Appreciate the additional ideas.