Configure alert flapping

You can set flapping properties to determine when an alert enters and exits the flapping state.

Before you begin

Role required: evt_mgmt_admin

About this task

Flapping condition occurs when the event source continues to generate events even after its associated alert has been closed. Flapping causes the status of the resource to repeatedly fluctuate between an Info Severity and another severity that requires attention (such as Critical).

An alert enters the flapping state when its current Flap Count value reaches or exceeds the given evt_mgmt.flap_frequency property value within the time period specified by the evt_mgmt.flap_interval property.

An alert exits the flapping state when the time interval between the latest occurrence of the event and the Flap last update time of the alert reaches or exceeds the evt_mgmt.flap_quiet_interval property value. An alert can also exit flapping in these conditions:

  • When an incoming event arrives after the flap_quiet_interval time has elapsed. The new alert generates and its state value depends on the incoming event severity.
  • After a background job, which runs every five minutes, verifies that no alert updates occurred and the flap_quiet_interval time has elapsed. If there are no updates, the alert shows the previous state value that it had before the background job ran.

Procedure

  1. Navigate to Event Management > Settings > Properties.
  2. Edit the following properties, as appropriate.
    • Minimum time in seconds before updating an alert for identical events (evt_mgmt.update_alert_restricted_fields_elapsed_time)
    • Flap interval (in seconds), within which an alert enters the flapping state (evt_mgmt.flap_interval)
    • Flap frequency, frequency an alert must reoccur to enter the flapping state (evt_mgmt.flap_frequency)

    • Flap quiet interval (in seconds), quiet time that must pass for an alert to exit the flapping state (evt_mgmt.flap_quiet_interval)

  3. Click Save.

What to do next

You can monitor the Event Management > All Alerts list for alerts that are in the flapping state. For details, see View alerts in the flapping state.