[detect][sysmem] Only report if error happened within 30 minutes

Old reports are effectively useless since the log events will have
disappeared. Since reports are suppressed for 24 hours after a report,
the current window could cause a report for something that happened
almost 24 hours earlier. Reduce the window to 30 minutes to prevent
stale events from being reported.

Bug: 76418

Change-Id: I1c112e7dee94edcd9df41de730597fbcfce6c3af
Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/527766
Reviewed-by: Christopher Johnson <crjohns@google.com>
Commit-Queue: John Bauman <jbauman@google.com>
diff --git a/src/diagnostics/config/triage/detect/sysmem-detect.triage b/src/diagnostics/config/triage/detect/sysmem-detect.triage
index 0dbca42..d15a559 100644
--- a/src/diagnostics/config/triage/detect/sysmem-detect.triage
+++ b/src/diagnostics/config/triage/detect/sysmem-detect.triage
@@ -6,18 +6,19 @@
         protected_allocation_failed_timestamp: "INSPECT:bootstrap/driver_manager:root/sysmem/heaps/SysmemAmlogicProtectedPool:last_allocation_failed_timestamp_ns",
     },
     eval: {
-        last_24_hours: "Fn([time], time > Now() - Hours(24))",
+        // Only report failures in the last 30 minutes, since earlier ones are unlikely to be in the logs
+        last_30_minutes: "Fn([time], time > Now() - Minutes(30))",
     },
     act: {
         protected_failed_today: {
             type: "Snapshot",
-            trigger: "And(Apply(last_24_hours, [protected_allocation_failed_timestamp]), protected_allocations_failed > 0)",
+            trigger: "And(Apply(last_30_minutes, [protected_allocation_failed_timestamp]), protected_allocations_failed > 0)",
             repeat: "Hours(24)",
             signature: "protected-allocations-failed-today",
         },
         contiguous_failed_today: {
             type: "Snapshot",
-            trigger: "And(Apply(last_24_hours, [contiguous_allocation_failed_timestamp]), contiguous_allocations_failed > 0)",
+            trigger: "And(Apply(last_30_minutes, [contiguous_allocation_failed_timestamp]), contiguous_allocations_failed > 0)",
             repeat: "Hours(24)",
             signature: "contiguous-allocations-failed-today",
         },
@@ -30,12 +31,13 @@
             no: [
                 "contiguous_failed_today",
             ],
-            now: "Hours(4)",
+            now: "Minutes(31)",
             values: {
                 // A day's worth of nanoseconds is 8.64e13, these numbers are within the last day.
                 protected_allocations_failed: 5,
                 contiguous_allocations_failed: 0,
-                protected_allocation_failed_timestamp: 100,
+                // 100 seconds.
+                protected_allocation_failed_timestamp: 100000000000,
                 contiguous_allocation_failed_timestamp: 0,
             },
         },
@@ -50,8 +52,10 @@
                 // A day's worth of nanoseconds is 8.64e13, these numbers are within the last day.
                 protected_allocations_failed: 5,
                 contiguous_allocations_failed: 3,
-                protected_allocation_failed_timestamp: 100,
-                contiguous_allocation_failed_timestamp: 200,
+                // 86400 seconds.
+                protected_allocation_failed_timestamp: 86400000000000,
+                // 86401 seconds.
+                contiguous_allocation_failed_timestamp: 86401000000000,
             },
         },
     },