Configure alert flapping
Set flapping properties to determine when an alert enters and exits the flapping state. Flapping can indicate configuration problems (that is, thresholds set too low), troublesome services, or real network problems.
Before you begin
Role required: evt_mgmt_admin
About this task
Flapping occurs when the event source continues to generate events even after its associated alert has been closed. Flapping causes the resource's status to repeatedly fluctuate between the OK severity and a severity requiring attention, for example, Critical.
Procedure
Navigate to All > Event Management > Administration > Event Management Properties.
Edit the following properties, as appropriate.
| Property | Description |
|---|---|
| evt_mgmt.update_alert_restricted_fields_elapsed_time | When the system receives events that do not update alerts—because the event data is not new and is identical to the existing alert—system fields are not updated by default. This helps reduce noise. For example, a "keep alive" event might be sent every few minutes from a server to confirm that a device is still connected, even if no new data is being exchanged. This property defines the minimum time interval \(in seconds\) that must pass before an alert can be updated based on identical events. If an identical event is received within this interval, the update is suppressed to avoid generating frequent, redundant notifications. By default, the interval is set to 86,400 seconds \(24 hours\). |
| evt_mgmt.flap_interval | Flap interval, in seconds, which is the time period within which an alert enters the flapping state. An alert enters the flapping state when its current Flap Count value reaches or exceeds the given evt_mgmt.flap_frequency property value within the time period specified by the evt_mgmt.flap_interval property. |
| evt_mgmt.flap_frequency | Flap frequency, frequency an alert must reoccur to enter the flapping state. |
| evt_mgmt.flap_quiet_interval | Flap quiet interval (in seconds), quiet time that must pass for an alert to exit the flapping state.An alert exits the flapping state when the time interval between the latest occurrence of the event and the Flap last update time of the alert reaches or exceeds the evt_mgmt.flap_quiet_interval property value. An alert can also exit flapping in these conditions:
|
- Click Save.
What to do next
You can monitor the Event Management > All Alerts list for alerts that are in the flapping state. For details, see View alerts in the flapping state.
Parent Topic:Alert lifecycle configuration
Related topics