Flap Detection Question

[tbmay]

Good morning,

I have a host that we got alerts saying it was flapping twice, which I can't see any evidence of state changes. All the services and the ping to the host looks good. No notifications. The graphs are well within parameters. Any idea how to proceed with the issue?

Thanks a million.

[lmiltchev]

I have a host that we got alerts saying it was flapping twice, which I can't see any evidence of state changes.

Did you check state change in Reports->State History (select the appopriate timeperiod)?
Is it possible you have timeout issues? Can you increase the timeout on the check?
You can also disable temporarily flapping on the host by going to: Home->Host Detail-><your host>->Advanced->Disable Flap Detection
...or you can try playing with different "Low/High flap threshold" values to see if this is going to resolve your issue (CCM->Hosts-><your host>->Modify->Check Settings).

[tbmay]

Thank you. It was a Windows box and apparently the "Uptime" service is in some sort of funk. It says there was a "Socket timeout after 10 seconds."

[slansing]

Flapping occurs when a object rapidly changes between states, this is done so that you are not spammed with notifications that only tell you it is going through state changes with no indication of why. Perhaps the check was timing out, and then going into an Ok state when it was able to route to your server properly, and then going back to a timeout. Flapping can be adjusted, but it is possible that there is an issue in the network, or on the windows server. Are your other services on this host reporting fine? You should be able to get a good idea through the state history report of if they were doing well prior to the flapping occurring, and that may help troubleshoot.