Child pages
  • Deduplication and storm control in opEvents

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: updated docs re opevents_flap_name

opEvents provides two mechanisms to handle repeated event occurrences in a practical fashion, namely stateful event deduplication and programmable event suppression.

Stateful Deduplication and Flaps

All events that are related to stateful entities (e.g. a node which can be in state up or down, an interface etc.) are automatically checked against the recent history of events and the known previous state of this entity. If the new  event reports the same state as the already known one, then the new event is suppressed completely: no event record is created  (except for raw logging, if that is enabled).

...

Related to that is the concept of a Flap, which in opEvents is defined as a transition sequence of from state up to down and back up transitions within a short time frame. opEvents uses the configuration option state_flap_window to define this window, by default 90 seconds.

In a flap situation , the up event is marked as flap (by setting the flap property to 1) and as associated with the down event , and its event name is (using the eventids or stateful_eventids property). In versions up to 2.2.1, the up event's name is always changed to "<state entity> Flap"; it is also marked as associated to the previous down event, and any repeat events that don't convey a new state are suppressed.
This behaviour newer versions of opEvents support the config option opevents_flap_name, which lets you specify a template (which can contain node.Xevent.Y and macro.Z placeholders, e.g. "event.event for event.stateful - Flap").

The interaction between down and up events in a flap situation can be fine-tuned using the configuration option opevents_no_action_on_flap (default: "true"): when .

  • When set to "true" opEvents will automatically acknowledge the related down event and set the down event's action_required to false. This causes any actions defined in policies for the down event to be stopped

...

  • (including escalation actions). The down event is thus closed and disposed of on receiving the up event.
  • On the other hand, if opevents_no_action_on_flap is false, then the down event is not modified in any way and remains open when a flap is detected; it is thus trackable independent of the up event.

Involved Event Properties

...