Kaseya Community

Am I misunderstanding how flap prevention works?

This question is answered

I'm fairly new to Traverse, and I'm tuning it to minimise false alarms. It's going well except that I fear I'm not really grokking how flap prevention works.

If an event (say, SQL Server Key Lock Requests) cycle length is set to 5 minutes, and I've set flap prevention to 10 cycles, I would assume that Key Lock Requests must exceed it's threshold consistently for 50 minutes before I'd get an email.

This doesn't appear to be the case. It might fire for 15 minutes total, and I get an email. This is true of a bunch of other events also.

What am I missing?

Sorry if this is a newb question. The docs seem to imply my understanding is correct, so I can't see why it's not functioning as it should.

Verified Answer
  • Well, in order for Traverse to send an email you need to create an Action Profile and assign it to the test. But you can create many different Action Profiles and assign different ones to different tests, so I'm not sure I understand your comment about having one global setting for all types of alerts. Can you elaborate?

    What I was trying to explain that the flap prevention setting has no impact on the Action profiles (this is why the Action profiles have a separate option to select after how many failures you want the action to fire).

  • Hi Greig,

    As Krisztian correctly indicated, the flap prevention setting affects the visibility of an event, either within the summary views or event console. Lets assume you have set flap prevention to 1, which can be accomplished globally, per-device or per-test basis. When a DGE/DGEx determines that a particular test has gone from OK to critical state, it will place it in a "transient" state instead for one additional polling cycle. If the status is still determined to be critical, then it will be shown as such on the UI.

    The actions profiles, which are used to send notification via email or other method are not affected by this flap prevention setting. Instead, they have their own deferral mechanism. Using your earlier example, you could set the action item with "Notification should happen after" option set to 10 cycles. In that case your will receive an alert after the SQL Server Key Lock request has been in the same state for at least 50 minutes.

    Please note that you can have multiple action profiles where one is set to send notification immediately and another with a built-in delay. Depending on the nature or importance of the metric, you can choose which action profile to assign to different tests.

    Regards - Rajib

All Replies
  • Greig,

    If I'm not mistaken, flap prevention settings are different from the settings you specify in you action profiles. In other words, flap prevention determines when an alert will show up in the Event Manager or on the Status pages, while settings in your Action profiles determine when it will send an email, text, or execute other action.

    Maybe someone from Kaseya can confirm this.

    Regards,

    Krisztian

  • That would seem odd, as for some events, I'd want to be notified immediately (say, disk space over a certain threshold on a certain drive) but others, only if they persist for some time. Example, physical memory. Yes, it'll be high for periods during intensive operations. I want to know if it stays in that state for more than, say, 30 minutes as that would indicate a problem.

    Doing that in the action profile would mean I only have one global setting for all types of alerts.

    But yes, I'd love to hear from a Kaseyan. The Traverse forum seems very quiet. Is nobody using it? It seems to be an excellent product overall.

  • Well, in order for Traverse to send an email you need to create an Action Profile and assign it to the test. But you can create many different Action Profiles and assign different ones to different tests, so I'm not sure I understand your comment about having one global setting for all types of alerts. Can you elaborate?

    What I was trying to explain that the flap prevention setting has no impact on the Action profiles (this is why the Action profiles have a separate option to select after how many failures you want the action to fire).

  • Hi Greig,

    As Krisztian correctly indicated, the flap prevention setting affects the visibility of an event, either within the summary views or event console. Lets assume you have set flap prevention to 1, which can be accomplished globally, per-device or per-test basis. When a DGE/DGEx determines that a particular test has gone from OK to critical state, it will place it in a "transient" state instead for one additional polling cycle. If the status is still determined to be critical, then it will be shown as such on the UI.

    The actions profiles, which are used to send notification via email or other method are not affected by this flap prevention setting. Instead, they have their own deferral mechanism. Using your earlier example, you could set the action item with "Notification should happen after" option set to 10 cycles. In that case your will receive an alert after the SQL Server Key Lock request has been in the same state for at least 50 minutes.

    Please note that you can have multiple action profiles where one is set to send notification immediately and another with a built-in delay. Depending on the nature or importance of the metric, you can choose which action profile to assign to different tests.

    Regards - Rajib

  • Thanks Rajib and Krisztian - that answers it well. :)