...

A quick not on stringwise and numerically.  If $r is 0, $r == 0 is true, $r eq "0" is also true.  If $r is 00, $r == 0 is true, $r eq "0" is false.  That's the basic idea.

Where to add the Alert

The alert can be added to current variables being polled from the devices, or a new section can be added.  For example a new section in Model->system->sys could be added which might look like this.

 'sys' => {
   'alerts' => {
     'snmp' => {
       'tcpCurrEstab' => {
 'oid' => 'tcpCurrEstab',
 'title' => 'TCP Established Sessions',
 'alert' => {
 'test' => '$r > 250',
 'event' => 'High TCP Connection Count',
 'level' => 'Warning'
 }
 }
 }
 },

Example

The following is an example of the layout of an alert (in this example serialNum is taken from Model-CiscoRouter.nmis) and uses a string based (stringwise) comparison:

...

'cipSecGlobalActiveTunnels' => {
  'oid' => 'cipSecGlobalActiveTunnels',
  'title' => 'Global Active Tunnels',
  'alert' => {
    'test' => '$r == 0',
    'event' => 'No tunnels present',
    'level' => 'critical'
  }
}       

Another example might be to check the number of TCP Connections to a server and alert when it is higher than 250.

 'tcpCurrEstab' => {
   'oid' => 'tcpCurrEstab',
   'title' => 'Current TCP Established Sessions',
   'alert' => {
     'test' => '$r > 250',
     'event' => 'High TCP Connection Count',
     'level' => 'Warning'
   }
 }

Adding the alert also adds the information to the "Device Details" panel, so you get the last polled value displayed all the time.

Image Added