How does Entuity handle port flapping?

The port flapping implementation includes techniques that you can also use when developing your own events. Flapping is a set of rules applied during Pre Storage processing, which is before events are saved to the Entuity database, displayed in the UI, or forwarded to integrations.

The following example covers the following:

• assumes a port alternates between 4 states within a 2 minute period, which is the Entuity default definition of a flapping period.
• shows how the unifying events, Port Up and Port Down, are used to combine the same type of information coming from different types of alerts (traps and SNMP polling).
• details why the unifying event appears to the end user as the originating event, for example Entuity may raise the Port Down event but it displays as Port Link Down (or Port Operationally Down), and how you can amend this default behavior.
• includes the derived event Port Flapping.
• shows how and why the events control an associated incident.

How Entuity handles a flapping port, one that goes up, down, up, down:

1. Entuity receives a trap which it handles as a Port Link Up event. Entuity applies the Unify Port Up Event rule. As a Port Link Up event it meets the condition and so Entuity performs the action, setting the event type to Port Up. All other details associated with the event are retained, including the event name. If you wanted to set the event name to match the event type then you would create an additional action to set the event name attribute:
   

   Set Attribute name = "Port Up"

   Entuity applies the Detect Port Flapping rule which identifies the port as not flapping because the number of changes in the port state is not 4 or more within the previous 2 minutes. Entuity saves to the database the Port Up event which displays in the viewer with the event name Port Link Up.
2. Entuity polls the port, detects it is up and raises a Port Operationally Down Cleared event. Entuity applies the Unify Port Up Event rule. As a Port Operationally Down Cleared event it meets the condition and so Entuity performs the action, setting the event type to Port Up. All other details associated with the event are retained, including the event name. Entuity applies the Detect Port Flapping rule which identifies the port as not flapping because the port is already set to down. Entuity saves to the database the Port Up event which displays in the viewer as a Port Operationally Down Cleared event.
3. Next the port goes down, for simplicity we will restrict the example to trap events. Entuity receives a trap which it handles as a Port Link Down event. Entuity applies the Unify Port Down Event rule. As a Port Link Down event it meets the condition and so Entuity performs the action, setting the event type to Port Down. All other details associated with the event are retained, including the event name. Entuity raises the Port Status Problem incident. Entuity applies the Detect Port Flapping rule which identifies the port as not flapping because the number of changes in the port state is not 4 or more within the previous 2 minutes. Entuity saves to the database the Port Down event which displays in the viewer as a Port Link Down event.
4. The port goes up. Entuity receives a trap which it handles as a Port Link Up event and after applying the Unify Port Up Event rule raises a Port Up event. Entuity closes the Port Status Problem incident. Entuity applies the Detect Port Flapping rule, identifies the port as not flapping and so saves to the database the underlying Port Up event but displays it in the viewer as a Port Link Up event. Entuity also closes the Port Status Problem incident.
5. Next the port goes down. Entuity receives a trap which it handles as a Port Link Down event. Entuity applies the Unify Port Down Event rule. As a Port Link Down event it meets the condition and so Entuity performs the action, setting the event type to Port Down. All other details associated with the event are retained, including the event name. Entuity raises the Port Status Problem incident. Entuity applies the Detect Port Flapping rule which identifies the port as flapping because the number of changes in the port state is 4 within the previous 2 minutes. Entuity saves to the database the Port Down event and raises the Port Flapping event. The Port Link Down event is not displayed until the Port Flapping event expires, or the port again changes state. You can view the events that contribute to the derived Port Flapping event by highlighting the event and from the context menu clicking Show Details.