[Xymon] Documentation on flapping status is unclear

[SebA]

Henrik, probably,

Why is this the case:
<QUOTE>The flap-count setting should be at least (N/300)-1, e.g. if you set
flap-seconds to 3600 (1 hour), then flap-count should be at least
(3600/300)-1, i.e. 11.</QUOTE>

I presume these figures come from an assumption that connection checks and
status updates are done every 5 minutes per host/test... because 300 is 5
minutes and 5 minute is the default xymonnet and xymon-client interval.

In my case connection checks are done every minute, and TBH I think the only
use of flap detection is for connection checks. It creates far too many
alerts for custom statuses - and even for disk space alarms: if I wanted
flap detection on it, I would just set it to alert immediately, if not, I
set the initial delay to e.g. 30 minutes.

So, if my connection checks are done every minute by a single xymonnet (and
xymonnetagain running at 30 second intervals), it should be possible to get
30 flaps in 30 minutes (ignoring xymonnetagain for now). Changing the 300
above to 60: (1800/60)-1=29. So I should set my flap-count to 29 if I follow
this formula? But why does one have to have at least the number from the
formula? Would 20 not be enough flaps in a 30 minute period (with testing at
least once a minute)? Is the problem that xymond is only remembering the
last flap-count statuses (for each test) and not flap-count status
_changes_?

Kind regards, 

SebA  
   

> -----Original Message-----
> From: xymon-bounces at xymon.com 
> [mailto:xymon-bounces at xymon.com] On Behalf Of Elizabeth Schwartz
> Sent: 28 March 2011 19:46
> To: xymon at xymon.com
> Subject: Re: [Xymon] ISO documentation on flapping status?
> 
> To answer my own question I found the flapping doc, in xymond. Putting
> it here in case anyone else is looking
> --flap-count=N
> Track the N latest status-changes for flap-detection. See the
> --flap-seconds option also. To disable flap-checks, set N to zero.
> Default: 5
> 
> --flap-seconds=N
> If a status changes more than flap-count times in N seconds or less,
> then it is considered to be flapping. In that case, the status is
> locked at the most severe level until the flapping stops. The history
> information is not updated after the flapping is detected. NOTE: If
> this is set higher than the default value, you should also use the
> --flap-count option to ensure that enough status-changes are stored
> for flap detection to work. The flap-count setting should be at least
> (N/300)-1, e.g. if you set flap-seconds to 3600 (1 hour), then
> flap-count should be at least (3600/300)-1, i.e. 11. Default: 1800
> seconds (30 minutes).
> 
> 
> On Mon, Mar 28, 2011 at 2:00 PM, Elizabeth Schwartz
> <betsy.schwartz at gmail.com> wrote:
> > We've got a bunch of servers showing as "flapping".
> >
> > I understand that this is a new feature but haven't found 
> the docs on
> > how to tweak it. Where and how can this be changed?
> >
> > thanks Betsy
> >
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
> 
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 2013.0.2897 / Virus Database: 2639/6082 - Release 
> Date: 02/04/13