View alerts in the flapping state

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 1 minute to read

    • View alerts that have been opened and closed at a high rate, called flapping alerts.

    Before you begin

    Ensure that your administrator has configured the alert flapping properties. For more information, see Configure alert flapping.

    Role required: evt_mgmt_admin, evt_mgmt_operator, or evt_mgmt_user

    About this task

    Flapping occurs when the event source continues to generate events even after its associated alert has been closed. Flapping causes the resource's status to repeatedly fluctuate between the OK severity and a severity requiring attention, for example, Critical.

    The frequency of events from an identical source within a time interval defined by the evt_mgmt.flap_frequency and evt_mgmt.flap_interval property values determines whether an alert is in a flapping state or a new issue has occurred.

    • If the same issue is recurring, Event Management associates the new event with the existing alert and the state of the alert is set to Flapping.
    • If the issue occurs after the time interval expires, Event Management creates an alert.

    Procedure

    1. Navigate to All > Event Management > All Alerts.
    2. Select the number of an alert that is in the Flapping state.
    3. On the alert, select the Flapping tab.
      Table 1. Flapping tab on Alert form
      Field Description
      Flapping tab
      Flap count The number of times the alert has flapped—that is, has fluctuated between a closed and a non-closed state—within the flap interval since the start time in the Flap start window.
      Flap start window The initial start time to measure the flapping occurrences.
      Flap last update time The last time flapping occurred. This time is the platform processing time, not the source system time.
      Flap last state The state before the alert entered the flapping state.
    4. If the Parent field is empty, address this alert as a new issue.