Henrik, probably,
Why is this the case:
<QUOTE>The flap-count setting should be at least (N/300)-1, e.g. if you set
flap-seconds to 3600 (1 hour), then flap-count should be at least
(3600/300)-1, i.e. 11.</QUOTE>
I presume these figures come from an assumption that connection checks and
status updates are done every 5 minutes per host/test... because 300 is 5
minutes and 5 minute is the default xymonnet and xymon-client interval.
In my case connection checks are done every minute, and TBH I think the only
use of flap detection is for connection checks. It creates far too many
alerts for custom statuses - and even for disk space alarms: if I wanted
flap detection on it, I would just set it to alert immediately, if not, I
set the initial delay to e.g. 30 minutes.
So, if my connection checks are done every minute by a single xymonnet (and
xymonnetagain running at 30 second intervals), it should be possible to get
30 flaps in 30 minutes (ignoring xymonnetagain for now). Changing the 300
above to 60: (1800/60)-1=29. So I should set my flap-count to 29 if I follow
this formula? But why does one have to have at least the number from the
formula? Would 20 not be enough flaps in a 30 minute period (with testing at
least once a minute)? Is the problem that xymond is only remembering the
last flap-count statuses (for each test) and not flap-count status
_changes_?
Kind regards,
SebA
-----Original Message-----
From: xymon-bounces at xymon.com
[mailto:xymon-bounces at xymon.com] On Behalf Of Elizabeth Schwartz
Sent: 28 March 2011 19:46
To: xymon at xymon.com
Subject: Re: [Xymon] ISO documentation on flapping status?
To answer my own question I found the flapping doc, in xymond. Putting
it here in case anyone else is looking
--flap-count=N
Track the N latest status-changes for flap-detection. See the
--flap-seconds option also. To disable flap-checks, set N to zero.
Default: 5
--flap-seconds=N
If a status changes more than flap-count times in N seconds or less,
then it is considered to be flapping. In that case, the status is
locked at the most severe level until the flapping stops. The history
information is not updated after the flapping is detected. NOTE: If
this is set higher than the default value, you should also use the
--flap-count option to ensure that enough status-changes are stored
for flap detection to work. The flap-count setting should be at least
(N/300)-1, e.g. if you set flap-seconds to 3600 (1 hour), then
flap-count should be at least (3600/300)-1, i.e. 11. Default: 1800
seconds (30 minutes).
On Mon, Mar 28, 2011 at 2:00 PM, Elizabeth Schwartz
<user-c61747246f66@xymon.invalid> wrote:
We've got a bunch of servers showing as "flapping".
I understand that this is a new feature but haven't found
the docs on
how to tweak it. Where and how can this be changed?
thanks Betsy
Date: 02/04/13