I have always set flap detection to off for traps because I didn't think the flap detection algorithm would work properly with event driven, asynchronous input. I also think that since traps can represent many different parameters, it would be difficult for Icinga to know if a given parameter was flapping or if many parameters were reporting state changes which, if taken individually might not satisfy the flapping criteria. Unfortunately, we often have a case where traps are received reporting rapidly changing state of a given parameter and dozens of notifications are sent out in a short time reporting the same root problem. I have tried turning on flap detection which seems to help with stopping notifications but, predictably, results in the flapping state never clearing once the events cease.
Can anyone recommend any best practices for dealing with nuisance notifications caused by a flurry of traps? Any advice is greatly appreciated. Thanks! Best Regards, Lyn Lyn Robertson Network Engineer/Cloud & Hosted Solutions 1000 NE Circle Blvd, Corvallis, OR 97330 | t: +1 541.738.5765 | c: +1 541.619.3219 [cid:image002.jpg@01CD9582.7ADD1A10]<http://www.polycom.com/>
<<inline: image002.jpg>>
------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________ icinga-users mailing list icinga-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/icinga-users
