If an alert is in the flapping state, you might need to triage the alert again.

Before you begin

Note: The Operator Workspace interface is available only for customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which provides an enhanced UI for managing alerts. For details, see Service Operations Workspace for ITOM.

Role required: evt_mgmt_operator

About this task

If an event repeatedly triggers the same alert in a short amount of time, the alert is put into the flapping state, even if an operator closed it previously. The event can also be fluctuating between severity levels, such as Info and Critical. You should triage the alert again, and take action to try to prevent the event from reoccurring.
Note: Your Event Management administrator can configure several settings that determine when to mark an alert as flapping, and other settings that determine what action you can take. This topic covers a generic example.

Procedure

  1. Find alerts in the flapping state:
    1. Navigate to Event Management > Operators Workspace.
    2. Modify the list of alerts by clicking the filter icon (Filter icon) and specifying criteria to find flapping alerts.
      Click Advanced view to modify filter settings. For example, you can specify:

      State | is | Flapping.

  2. Click the alert number to open it.
  3. On the alert, click the Flapping tab and review the information:
    Field Description
    Flap count

    The number of times the alert started flapping since the time in the Flap start window field.
    Flap start window

    The time that flapping started.
    Flap last update time

    The last time flapping occurred. This time is the instance processing time, not the source system time.
    Flap last state

    The state of the alert before it entered the flapping state.
  4. Decide which action to take based on how often flapping has occurred.
    You can do any of the following, depending on what your organization's standard operating procedures are and what your Event Management administrator configured:
  5. After you are certain that the underlying issue is addressed, close the alert.