On Tue, 18 Sep 2012, Robertson, Lyn wrote:
> I have always set flap detection to off for traps because
> I didn't think the flap detection algorithm would work properly
> with event driven, asynchronous input. I also think that since
> traps can represent many different parameters, it would be
> difficult for Icinga to know if a given parameter was flapping
> or if many parameters were reporting state changes which, if
> taken individually might not satisfy the flapping criteria.
Much of this has to do with how well the MIB for the monitored
device in question was constructed. Some devices lend themselves
well for trap-integration with passive (and volatile!) services
and some don't. Ones that work well are ones that have separate
OIDs for events and event-clearing events (e.g. "fan failure"/
"fan recovery").
> Unfortunately, we often have a case where traps are received
> reporting rapidly changing state of a given parameter and dozens
> of notifications are sent out in a short time reporting the
> same root problem.
In this case, I developed a trap-handler designed to be called
from NET-SNMP that (a) suppresses duplicate traps (on a per-host,
per-OID basis) and (b) can route said traps into either Icinga or
out via e-mail. I rather suspect it's a workalike for SNPTT and
friends, but I've had good luck with it so far. If anyone is
interested in it I can write more on it. The main drawback is
that it requires a MySQL database backend to keep the routing
information and trap history for suppressing duplicates.
> I have tried turning on flap detection which seems to help with
> stopping notifications but, predictably, results in the flapping
> state never clearing once the events cease.
That's because there is not usually a constant stream of "OK"
status polls to clear the object in question (be it host or
service). In this case, flap detection is useless and must be
handled in some other manner.
Cheers!
+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfri...@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
icinga-users mailing list
icinga-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/icinga-users
