[#ZBXNEXT-6642] Add flapping interface trigger to "Interfaces SNMP"

[ZBXNEXT-6642] Add flapping interface trigger to "Interfaces SNMP" Created: 2021 Apr 28 Updated: 2023 Nov 01
Status:	Open
Project:	ZABBIX FEATURE REQUESTS
Component/s:	Templates (T)
Affects Version/s:	5.2.6
Fix Version/s:	None

Type:

New Feature Request

Priority:

Medium

Reporter:

Boden Garman

Assignee:

Zabbix Integration Team

Resolution:

Unresolved

Votes:

Labels:

None

Remaining Estimate:

Not Specified

Time Spent:

Not Specified

Original Estimate:

Not Specified

Description

Hello,

I am proposing a new trigger to detect if an interface is "flapping" ie going up and down multiple times in a short period of time is added to the official "Interfaces SNMP" template. This is to avoid multiple "problem / resolved" alerts for administrators if an interface is constantly going up and down

The "Interface {#IFNAME}({#IFALIAS}): Link down" prototype should be dependent on this new trigger as well to avoid triggering constantly.

Possibly using count on ifOperStatus and checking for more than 5 values of 1 (up) and 2 (down) in a ten minute interval or so, but there is possibly a more elegant way

Comments

Comment by Boden Garman [ 2021 Apr 28 ]

Something like this, perhaps (under name: 'Interface {#IFNAME}({#IFALIAS}): Operational status')

                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and ({count(15m,1)}>5 and {count(15m,2)}>5)'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: '{$IFCONTROL:"{#IFNAME}"}=0 or {count(5m,2)}=0'
                  name: 'Interface {#IFNAME}({#IFALIAS}): Link flapping'
                  priority: AVERAGE
                  description: |
                    This trigger will detect if an interface has changed operational state more than 5 times in a 5 minute period

                    Use {$IFCONTROL:"{#IFNAME}"}=0 to disable this trigger for an interface.
                  manual_close: 'YES'

Comment by Orion Poplawski [ 2023 Nov 01 ]

What about (untested):

- uuid: ddbec6eb34294e3dbbc794d833d36960
{{ expression: '{$IFCONTROL:"

{#IFNAME}"}=1 and changecount(/Cisco IOS by SNMP/net.if.statusifOperStatus.{#SNMPINDEX},5m)>2'}}
recovery_mode: RECOVERY_EXPRESSION
{{ recovery_expression: '{$IFCONTROL:"{#IFNAME}

"}=0 or count(/Cisco IOS by SNMP/net.if.statusifOperStatus.{#SNMPINDEX},5m,,2)=0'}}
name: 'Interface {#IFNAME}({#IFALIAS}): Link flapping'
event_name: 'Interface {#IFNAME}({#IFALIAS}): Link flapping (>2 transitions in 5m)'
priority: HIGH
description: |
This trigger will detect if an interface has changed operational state more than 2 times in a 5 minute period{{ Use {$IFCONTROL:"

{#IFNAME}

"}=0 to disable this trigger for an interface.}}
manual_close: 'YES'
tags:
- tag: scope
value: availability
- tag: scope
value: performance

Generated at Tue Jul 01 09:09:37 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.

[ZBXNEXT-6642] Add flapping interface trigger to "Interfaces SNMP" Created: 2021 Apr 28 Updated: 2023 Nov 01