Work with flapping alerts

If an alert is in the flapping state, you might need to triage the alert again.

Before you begin

Note:

The Operator Workspace interface is available only to customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which offers an enhanced UI for managing alerts.

Role required: evt_mgmt_operator

About this task

If an event repeatedly triggers the same alert in a short amount of time, the alert is put into the flapping state, even if an operator closed it previously. The event can also be fluctuating between severity levels, such as Info and Critical. You should triage the alert again, and take action to try to prevent the event from reoccurring.

Note:

Your Event Management administrator can configure several settings that determine when to mark an alert as flapping, and other settings that determine what action you can take. This topic covers a generic example.

Procedure

1. Find alerts in the flapping state:
   1. Navigate to Event Management > Operators Workspace.
   2. Modify the list of alerts by clicking the filter icon () and specifying criteria to find flapping alerts.
      Click Advanced view to modify filter settings. For example, you can specify:

      State | is | Flapping.

2. Click the alert number to open it.
3. On the alert, click the Flapping tab and review the information:

   Field	Description
   Flap count	The number of times the alert started flapping since the time in the Flap start window field.
   Flap start window	The time that flapping started.
   Flap last update time	The last time flapping occurred. This time is the instance processing time, not the source system time.
   Flap last state	The state of the alert before it entered the flapping state.

4. Decide which action to take based on how often flapping has occurred.
   You can do any of the following, depending on what your organization's standard operating procedures are and what your Event Management administrator configured:

   • Run a remediation workflow that might do something like reboot a server or reset a router.
   • Access a web application, like the application for your event monitoring software on your network.
   • Modify an associated incident or a KB article to include additional information or steps.
5. After you are certain that the underlying issue is addressed, close the alert.