Detecting Event Flaps

From Zenoss Wiki
This is the approved revision of this page, as well as being the most recent.
Jump to: navigation, search

Zenoss can help you decipher the noise around event flapping and help you identify and better manage event flapping in your environment.

Zenoss helps you get a clear, actionable signal out of event flapping noise by specifying event flapping settings as part of your event configuration properties.

By specifying event flapping configuration properties for events, if the severity level of an event changes a certain number of times within a certain time range, Zenoss generates an event flapping event under the event class /Status/Flapping. With this special event flapping event, you have a way to track and remediate transient issues.

To configure event flap detection in Zenoss:

  1. Ensure you are running version 4.2.5 or later.
  2. Navigate to Advanced -> Settings -> Events.
  3. Put a checkmark under Enable Event Flapping Detection
  4. On the Events tab, click Event Classes.
  5. In the left tree pane, click Configuration Properties.
  6. In the zFlappingIntervalSeconds field, specify the internal you want to use in seconds. The default is 3600 seconds, or one hour.
  7. In the zFlappingSeverity field, specify the appropriate value.
  8. In the zFlappingThreshold field, specify specify the amount of times an event can flap between the zEventSeverity and zFlappingSeverity bounds in the amount of time alloted in zFlappingIntervalSeconds.

For example, if you are switching from Error more than 4 times within 3600 seconds, Zenoss will generate an event flap event.

You can configure event flap detection for each event class as desired, and event flap detection is available for every type of event in Zenoss. You can adjust the time and threshold for event flapping to best meet your needs, as well as create transforms or triggers to action on flapping events.

For additional information about detecting and alerting on event flapping, see the Detecting the “Signal” in Event Flap “Noise” article, available on the Zenoss blog.