We’re looking to enhance our alerting to detect interface flaps while avoiding overlap with our existing device availability (ICMP reachability) alerts. Use ICMP-based monitoring to identify intermittent connectivity (flapping) without duplicating the current “device down” availability alerts.

Current ICMP device availability alert configuration
- Trigger condition: Maximum Availability = 0%
- Clear condition: Minimum Availability ≥ 80%
- Polling cadence: 5 consecutive pings every 5 minutes

Proposed ICMP strategy (to improve flap detection)
- Availability (Device Level)
- Trigger condition: Maximum Availability = 0% for 5 minutes (instead of 10 minutes)
- Clear condition: Minimum Availability = 100% every 5 minutes (instead of 10 minutes)
- Ping method: 15 pings per 5-minute interval, triggered every 21 seconds

Question / Request
- What is the best way in IBM’s platform to generate an alert for device interfaces (e.g., link up/down, interface operational status changes, interface flap detection), rather than only device-level ICMP reachability?

Specifically, could you please advise:
- Whether interface flap alerting is supported natively, and what feature/module enables it
- Recommended approach (e.g., SNMP interface operStatus/adminStatus, IF-MIB, traps, streaming telemetry, etc.)
- How to configure thresholds to detect flaps (e.g., X transitions within Y minutes)
- How to ensure interface alerts do not conflict with or duplicate existing device availability alerts

What we have on the Interface object for availability is four main things:

1. The presence or lack of data
   1. This may be caused because the device is not reachable
   2. May also occur because the device is not reporting the interface's statistics.
2. The Enabled indicator - the results of walking ifAdminStatus
3. The Operation indicator - the results of walking ifOperStatus
4. The Availability indicator - synthetic indicator that uses ifOperStatus,
   1. if ifOperstatus is 1, it reports 100%. if it is not 1, it reports 0%.
   2. This shows as 0% even if the result is a method other than 2, such as 3 - testing, 4 - unknown, etc.

If the device itself becomes unreachable, we shouldn't be getting results of ifAdminStatus or ifOperStatus.

Effectively, there would be a gap in the data, not 0s.

So if you make policies based on Availability < 100%, then this should only trigger when we have 0% datapoints.

As far as detecting specifically flaps as opposed to general interface level outages, this becomes more difficult.

If an interface is flapping, IE availability shows 100,0,100,0,100, etc. then you could use something like count over threshold as a trigger.

That would look at the data points and trigger if X datapoints met the trigger condition even if they aren't concurrent.