What is flapping?
Flapping is when a monitored check keeps switching between healthy and failing in a short time, for example down, up, down, up within minutes. Each change would normally send an alert, so one unstable service floods your channels. Monitoring tools detect flapping by counting state changes in a window and send one flapping alert instead.
Why flapping matters
A flapping check is a real problem (an overloaded server answering some requests, a health check right at its timeout, one failing node behind a load balancer) wrapped in a lot of noise. Twenty down and up messages hide the one message that matters and train people to mute the channel.
Treating flapping as its own state keeps the signal (this service is unstable) and drops the noise (each individual change).
How to measure flapping
flapping when state changes within a window ≥ threshold Vigil: 4 or more changes in 30 minutes → one flapping alert; stable again after 15 minutes without a change Nagios: weighted percentage of state changes over the last 21 checks, compared with high and low thresholds
Worked example
A monitor goes down at 10:02, up at 10:04, down at 10:11 and up at 10:12, then stays up.
- State changes in the 30 minutes from 10:00: 4.
- 4 reaches the threshold of 4 changes in 30 minutes, so the monitor is flapping: one flapping alert goes out instead of four down and up alerts.
- The last change was at 10:12; after 15 quiet minutes, at 10:27, the monitor is reported stable again.
Result: The team hears about the instability once, with the full pattern, and can treat it as one incident to investigate.
Common mistakes
- Raising the threshold until it stops. If the check flaps because the service is unstable, a higher threshold only hides it.
- Timeouts that equal the response time. A 2-second timeout on an endpoint that takes 1.9 s will flap. Give timeouts headroom and alert on latency separately.
- Single-path checks. One unreliable network path looks like flapping. Confirm failures with a second check.
- Ignoring flapping once it is quiet. Flap suppression stops the noise, not the problem. Investigate a flapping alert like any other incident.
How Vigil handles flapping
- Vigil marks a monitor as flapping after 4 or more state changes in 30 minutes, sends one flapping alert, and reports it stable again after 15 minutes without changes.
- Every failure is confirmed by a second check about 12 seconds later, which removes most single-blip flaps before they start.
- Adaptive latency alerts learn a 7-day baseline, so a slowing endpoint can open a degraded incident before it starts timing out and flapping.
Flapping: frequently asked questions
What causes flapping?
Common causes are an overloaded server that answers some requests, a timeout set too close to the normal response time, one unhealthy instance behind a load balancer, and unreliable network paths between the checker and the service.
Should flapping page someone?
A brief flap usually should not; a service that keeps flapping for long periods is unstable and deserves attention. One flapping alert keeps people informed without a flood.
Where does the term come from?
It is long-standing monitoring jargon. Nagios, for example, has had flap detection based on the percentage of state changes over recent checks for many years.