In the final step of configuring your log source, you have the option to create an alarm in case the source does not process any events within a configurable period of time. For example, if you configure the threshold to 15 minutes, then you will receive an alert if no events are processed in 15 minutes. The alert is only sent one time; there is no re-notification for event threshold.