Configure alert flapping
Set flapping properties to determine when an alert enters and exits the flapping state. Flapping can indicate configuration problems (that is, thresholds set too low), troublesome services, or real network problems.
Before you begin
About this task
Flapping occurs when the event source continues to generate events even after its associated alert has been closed. Flapping causes the resource's status to repeatedly fluctuate between the OK severity and a severity requiring attention, for example, Critical.
Procedure
- Navigate to .
-
Edit the following properties, as appropriate.
Property Description evt_mgmt.update_alert_restricted_fields_elapsed_time When the system receives events that do not update alerts—because the event data is not new and is identical to the existing alert—system fields are not updated by default. This helps reduce noise. For example, a "keep alive" event might be sent every few minutes from a server to confirm that a device is still connected, even if no new data is being exchanged.
This property defines the minimum time interval (in seconds) that must pass before an alert can be updated based on identical events.
If an identical event is received within this interval, the update is suppressed to avoid generating frequent, redundant notifications. By default, the interval is set to 86,400 seconds (24 hours).
evt_mgmt.flap_interval Flap interval, in seconds, which is the time period within which an alert enters the flapping state.
An alert enters the flapping state when its current Flap Count value reaches or exceeds the given evt_mgmt.flap_frequency property value within the time period specified by the evt_mgmt.flap_interval property.
evt_mgmt.flap_frequency Flap frequency, frequency an alert must reoccur to enter the flapping state. evt_mgmt.flap_quiet_interval Flap quiet interval (in seconds), quiet time that must pass for an alert to exit the flapping state. An alert exits the flapping state when the time interval between the latest occurrence of the event and the Flap last update time of the alert reaches or exceeds the evt_mgmt.flap_quiet_interval property value. An alert can also exit flapping in these conditions:
- When an incoming event arrives after the flap_quiet_interval time has elapsed. The new alert generates and its state value depends on the incoming event severity.
- After a background job, which runs every five minutes, verifies that no alert updates occurred and the flap_quiet_interval time has elapsed. If there are no updates, the alert shows the previous state value that it had before the background job ran.
- Click Save.