The appliance's email alerting went live early, pointed at every category and every administrator's inbox. Within a month the backup team had a rule archiving all of it unread. How should mail alerting actually be configured?

Mail alerting works when it is filtered, addressed and subordinate; this deployment failed all three by pointing every category at every inbox, and the archive rule is the rational endpoint of an unreadable channel. Correct configuration is deliberate: recipient lists by audience - storage operations, facilities, whoever owns each failure class - with category and severity filters so email carries only events those people can act on, leaving the monitoring platform primary while mail complements it for the few events that must reach someone not watching a dashboard. Widening recipients to all of IT multiplies the same unread inbox across more humans; 'someone awake will notice' is diffusion of responsibility dressed as redundancy, burying the two or three categories genuinely worth reading. Disabling mail entirely solves the noise problem by killing the signal - the channel's strength is reaching a person away from their console for critical hardware or capacity events, which a dashboard path is not. A daily digest batches the volume but inverts urgency: a drive failure parked in tonight's summary defeats the purpose of notification, and the root cause - unfiltered categories - survives, merely queued. The exam angle: design notification by audience, then severity, then urgency - never by volume. Operational check: send a filtered test event for each audience and verify each lands in exactly one intended inbox within the response window the runbook promises.