Henrik, probably,

Why is this the case: <QUOTE>The flap-count setting should be at least (N/300)-1, e.g. if you set flap-seconds to 3600 (1 hour), then flap-count should be at least (3600/300)-1, i.e. 11.</QUOTE>

I presume these figures come from an assumption that connection checks and status updates are done every 5 minutes per host/test... because 300 is 5 minutes and 5 minute is the default xymonnet and xymon-client interval.

In my case connection checks are done every minute, and TBH I think the only use of flap detection is for connection checks. It creates far too many alerts for custom statuses - and even for disk space alarms: if I wanted flap detection on it, I would just set it to alert immediately, if not, I set the initial delay to e.g. 30 minutes.

So, if my connection checks are done every minute by a single xymonnet (and xymonnetagain running at 30 second intervals), it should be possible to get 30 flaps in 30 minutes (ignoring xymonnetagain for now). Changing the 300 above to 60: (1800/60)-1=29. So I should set my flap-count to 29 if I follow this formula? But why does one have to have at least the number from the formula? Would 20 not be enough flaps in a 30 minute period (with testing at least once a minute)? Is the problem that xymond is only remembering the last flap-count statuses (for each test) and not flap-count status _changes_?

Kind regards,

SebA

-----Original Message----- From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Elizabeth Schwartz Sent: 28 March 2011 19:46 To: xymon at xymon.com Subject: Re: [Xymon] ISO documentation on flapping status?

To answer my own question I found the flapping doc, in xymond. Putting it here in case anyone else is looking --flap-count=N Track the N latest status-changes for flap-detection. See the --flap-seconds option also. To disable flap-checks, set N to zero. Default: 5

--flap-seconds=N If a status changes more than flap-count times in N seconds or less, then it is considered to be flapping. In that case, the status is locked at the most severe level until the flapping stops. The history information is not updated after the flapping is detected. NOTE: If this is set higher than the default value, you should also use the --flap-count option to ensure that enough status-changes are stored for flap detection to work. The flap-count setting should be at least (N/300)-1, e.g. if you set flap-seconds to 3600 (1 hour), then flap-count should be at least (3600/300)-1, i.e. 11. Default: 1800 seconds (30 minutes).

On Mon, Mar 28, 2011 at 2:00 PM, Elizabeth Schwartz <betsy.schwartz at gmail.com> wrote:

...

We've got a bunch of servers showing as "flapping".

I understand that this is a new feature but haven't found the docs on how to tweak it. Where and how can this be changed?

thanks Betsy

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

---

No virus found in this message. Checked by AVG - www.avg.com Version: 2013.0.2897 / Virus Database: 2639/6082 - Release Date: 02/04/13