Hi, Jason.
The data in email is a data file that includes all data, including packet loss and good data. It exactly represents recent data in memory - the *quantity* of data represented is based on when the alert conditions started, and when the last email went out.
What you're asking for should be possible. You can set up two separate alerts:
One alert always fires (ie: when 1 or more of the last 5 samples is over 1ms), and set it up to email only once every 4 hours. You'll get 4 hours of data in each email (data up to the previous alert email that was sent, plus just a bit of overlap). The only goal of this alert is to email you data occasionally.
The second alert you set up for packet loss or latency (whatever conditions you need), and have it email immediately. This alert will include samples only for the period when alert conditions were happening, plus just a bit of time prior to that.
Then, tie both of these alerts to the IP Address you want to monitor (likely your final destination in this case) by tracing to that address, right-clicking the hop you want to "Watch", and then selecting "Watch this host (Alerts)..." from the menu. This will set up the alerts to watch that host.
The alerts make their own decisions about what data to include based on the conditions you configure (including the Traces to Examine), the last email that went out, and whether the alert is configured to send an email immediately or wait for a while.
Your alert configuration sounds good - you probably just missed the part where you need to tie the alert to a host (see two paragraphs up here).
The auto-save results are done completely separately from the alerts. Alerts don't check this or use this configuration in any way. You should be able to get the export (File / Export to Text File) to output data very similar to the alert email's data - where an * is a lost packet. If you can't, please send an email to
support@pingplotter.com with examples of both and we can help get things working for you.
- Pete