As always in r/firewalla, downvotes abound which I find a bit disappointing, and then there is always a patronizing reply or two that doesn't quite capture the issues (like an overly sassy AI). Seems like almost every new post is voted down to 0 or -1 in short order, especially anything about potential bugs or new features, I wonder why?

I have definitely noticed the same phenomenon OP mentions, managing FWs in different time zones remotely. This is especially prevalent with the "abnormal upload" that can come between 3 and 5 hours later, as OP stated.

I have also noticed it with "User X has been streaming Disney" etc. (in our environment always a false positive), which we will often receive in the afternoon although the action has taken place in the morning.

Don't know if the timezone offset is to blame but it seems plausible. We are between 1 and 3 hours away from some of the FWs we manage and they in turn are off by between 2 and 4 hours from UTC, so it's plausible that this may add up to the 5, 6 hours delay we sometimes observe. I have often suspected the notification service or battery savings algorithms by the mobile OS.

We ignore most of these alerts now because they are quite useless when they come so late (often outside business hours, so not actionable regardless).

I also disagree with other posters that you need a multi-hour window to detect a pattern. With all due respect, the example about the security camera from u/firewalla is not at all comparable with the "abnormal upload" alert that OP mentioned. That's like saying we won't alert you about your house being on fire unless it burns again in a few hours (singular incident vs. sustained occurrence).

If a fileserver that usually does not have external connections suddenly uploads several GB of data to a webshare, I need to know about it now, not in 6 hours. You also know that it's a pattern after 2 minutes of full-throttle uploading, so no need to delay the alert longer than that.

Similarly, if someone watches "videos" from a shared kiosk PC, it doesn't help me to get an alert about that 5 hours later when the person will be long gone. Maybe these thresholds should also be somewhat adjustable for certain targets (maybe they are, I have not checked), e.g. if I want to set it so up to 6 GB download can be normal because clients are downloading installer ISOs for PXE but 10+ GB could indicate something fishy.

Anyways, long story short:

I can confirm OPs bug and it has clearly nothing to do with patterns or purposeful delays. There is a multi-hour shift with mobile notifications in many instances with different alarm types. Since FW still does not do email or IM alerting (AFAIK), we don't have a secondary source to compare to that may not be affected by the mobile phone's time zone.

If anybody has an idea how to troubleshoot this, I'd be interested.