Nagios Support Forum

Hello,

We are getting a lot of flapping alerts at night when ISPs are running their maintenance. We definitely want to know if a connection is actually been marked as down, but we don't need to know if it is flapping. Is there a way to change this?

You can disable the flap detection for a particular host or a service by going to the CCM->Hosts (or Services)->set "Flap detection enabled" to "off" under the "Check Settings" tab.

You can also disable flap detection globally by going to Home->Monitoring Process->Process Info
and click on the "Disable" actions button next to the "Flap Detections".

Hope this helps.

We still want the flap detection during the day so we are alerted to a device or service going up and down, we just don't want to be notified of flapping after hours. We do still want to be notified if a device or service is actually down after hours.

Is there a way to do that?

There most definitely is. The best way would be to control the notifications through a contact template that only effects flapping notifications. Set it up with a time period for work hours. Remove flapping notifications from the contacts default template and from any per-contact settings. Just a tip, you can use the bulk modification tool to change the notification options system wide. This feature requires enterprise, but you can just trial the enterprise version to demo/use the feature.

Thank you for the help. I think I may be misunderstanding or missing a step. This is what I have done:

1. Remove flapping by unchecking the F on each individual contact and the contact template.
2. Create a new template and select only flapping and set the alert times to only during business hours.

How do I now associate that template with my existing contacts so that they are alerted to flapping only after hours, but retain their 24x7 reporting for everything else?

If you made a contact template, go to the CCM --> Contacts --> Click "Manage Contact Templates" --> add your template.

I need to do that on each individual contact, correct?

If you are using individual contacts you would need to, otherwise if you are using templates as Andy showed you can edit them in the same fashion. If you have Enterprise edition you can use the bulk modifications tool to do this over all of your contacts, CCM > Tools > Bulk Modifications Tool > Change Single Config Option > Flap_Detection_Enabled.

There must be a gap in my understanding. When I think of a template, I think of something that is used to create other things. All of our contacts are individual contacts. If I understand correctly, I just need to go into CCM > Contact > {Individual Contact} > Manage Contact Templates > and assign the new "Flapping" template that I created (and I understand this can also be done using the bulk edit tool, I am just trying to make sure I understand the flow).

So what takes precedence? There is the actual contact and then there are multiple contact templates. If there is conflicting information, which one wins out? Let's take an example:

User1: Flapping is set to off
User1 also has 2 templates applied: xi_contact_generic and Flapping_template. xi_contact_generic is set to notify when something flaps. Flapping_template is set to notify when something flaps.

User1 is currently not getting flapping alerts (User1 was getting flapping alerts prior to unchecking them on the contact), I assume because flapping alerts are disabled on the contact itself, but am not at all sure.

General rules of precedence:

- local variables take highest precedence
- top-most template takes precedence

Make sure the template with flapping alerts is the topmost template.