Work with flapping alerts
If an alert is in the flapping state, you might need to triage the alert again.
Before you begin
Note: The Operator Workspace interface is available only to customers who have upgraded from a release prior to the Utah release. New customers as of the Utah release can use the Service Operations Workspace for ITOM, which offers an enhanced UI for managing alerts.
Role required: evt_mgmt_operator
About this task
If an event repeatedly triggers the same alert in a short amount of time, the alert is put into the flapping state, even if an operator closed it previously. The event can also be fluctuating between severity levels, such as Info and Critical. You should triage the alert again, and take action to try to prevent the event from reoccurring.
Note: Your Event Management administrator can configure several settings that determine when to mark an alert as flapping, and other settings that determine what action you can take. This topic covers a generic example.
Procedure
Find alerts in the flapping state:
Navigate to Event Management > Operators Workspace.
Modify the list of alerts by clicking the filter icon (
Filter icon\) and specifying criteria to find flapping alerts.
Click **Advanced view** to modify filter settings. For example, you can specify:
`State` \| `is` \| `Flapping`.
Click the alert number to open it.
On the alert, click the Flapping tab and review the information:
| Field | Description |
|---|---|
| Flap count | The number of times the alert started flapping since the time in the Flap start window field. |
| Flap start window | The time that flapping started. |
| Flap last update time | The last time flapping occurred. This time is the instance processing time, not the source system time. |
| Flap last state | The state of the alert before it entered the flapping state. |
Decide which action to take based on how often flapping has occurred.
You can do any of the following, depending on what your organization's standard operating procedures are and what your Event Management administrator configured:
- Run a remediation workflow that might do something like reboot a server or reset a router.
- Access a web application, like the application for your event monitoring software on your network.
- Modify an associated incident or a KB article to include additional information or steps.
- After you are certain that the underlying issue is addressed, close the alert.
Parent Topic:Advanced tasks for the Event Management operator