I tested the network health page using two sampling values (1 and 50), and I noticed that when using sampling = 50, fewer alerts are shown. After investigation, I believe this behavior is caused by the lowVolumeThreshold.

lowVolumeThreshold filters using sampled values from NetObserv metrics, which causes alerts to disappear when the sampling rate increases.

Example

Health rule: PacketDropsByKernel
Sampling: 50
lowVolumeThreshold: "5"

Real traffic: 250 packets/s
Observed: 5 packets/s (250 / 50)
Filter:total_packets_rate > 5 -> 5 > 5 -> fails

1.Configure NetObserv with sampling = 50
2.Open the network health page
3.Observe alerts/recording rules generated by health rules that use lowVolumeThreshold (for example, PacketDropsByKernel)
4.Compare the behavior with sampling set to 1 and sampling set to 50

When the sampling value is increased, some alerts/recording are no longer triggered

Alerts/recording should be evaluated consistently regardless of the sampling rate, using normalized metrics so that lowVolumeThreshold reflects the real traffic volume.