Notification got 1 hour delay due to host flapping alert

[burhandm (burhanuddin)]

CMK version: cmk --version This is Check_MK version 2.4.0p21 CRE
OS version: OMD - Open Monitoring Distribution Version 2.4.0p21.cre

Recently, we enabled flapping detection for both hosts and services. However, we observed an issue where a monitored device remained in a DOWN state for approximately one hour, but no notification was generated during that period.

Need help for below pointer:

• Flapping should continue to be detected and monitored.

• A host DOWN notification should be triggered within 5 minutes of the outage.

• Notification delivery should not be delayed due to flapping configuration.

[dineshinspace (Dinesh)]

Hello @burhandm ,

This is normal behavior when flapping detected. in your snapshot, host down alert came before “Host Flapping Stopped”. Please go through section 4.5 in Notification basics , it clearly mentioned “As long as an object is flapping, successive state changes trigger no further notifications.”

Regards,

DD

[andreas-doehler (Andreas)]

@burhandm

• Flapping should continue to be detected and monitored.
• A host DOWN notification should be triggered within 5 minutes of the outage.

As @dineshinspace already wrote you can only have one of the two not booth.
You can disable flap detection or you can have the system like it is now.

[rons4 (Ron)]

Maybe the alerting side can help here as well. For example, SIGNL4 can be configured to wait until a problem persists for a certain period before sending an alert.

You can also define thresholds such as: one flap within 10 minutes is acceptable, but if the same problem occurs twice within 10 minutes, an alert is triggered.