--- title: Configure alert flapping description: Set flapping properties to determine when an alert enters and exits the flapping state. Flapping can indicate configuration problems \(that is, thresholds set too low\), troublesome services, or real network problems. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/event-management/t\_EMConfigAlertStateFlapDetect.html release: australia product: Event Management classification: event-management topic_type: task last_updated: "2026-03-12" reading_time_minutes: 2 breadcrumb: [Alert lifecycle configuration, Manage and monitor alerts, Configure, Event Management, ITOM AIOps, IT Operations Management] --- # Configure alert flapping Set flapping properties to determine when an alert enters and exits the flapping state. Flapping can indicate configuration problems \(that is, thresholds set too low\), troublesome services, or real network problems. ## Before you begin Role required: evt\_mgmt\_admin ## About this task Flapping occurs when the event source continues to generate events even after its associated alert has been closed. Flapping causes the resource's status to repeatedly fluctuate between the **OK** severity and a severity requiring attention, for example, **Critical**. ## Procedure 1. Navigate to **All** > **Event Management** > **Administration** > **Event Management Properties**. 2. Edit the following properties, as appropriate.

Property	Description
evt\_mgmt.update\_alert\_restricted\_fields\_elapsed\_time	When the system receives events that do not update alerts, system fields are not updated by default. This occurs when the event data is identical to the existing alert. This helps reduce noise. For example, a "keep alive" event might be sent every few minutes from a server. This confirms that a device is still connected, even if no new data is being exchanged. This property defines the minimum time interval \(in seconds\) that must pass before an alert can be updated based on identical events. If an identical event is received within this interval, the update is suppressed to avoid generating frequent, redundant notifications. By default, the interval is set to 86,400 seconds \(24 hours\).
evt\_mgmt.flap\_interval	Flap interval, in seconds, which is the time period within which an alert enters the flapping state. An alert enters the flapping state when its current Flap Count value reaches or exceeds the given evt\_mgmt.flap\_frequency property value within the time period specified by the __evt\_mgmt.flap\_interval__ property.
evt\_mgmt.flap\_frequency	Flap frequency, frequency an alert must reoccur to enter the flapping state.
evt\_mgmt.flap\_quiet\_interval	Flap quiet interval \(in seconds\), quiet time that must pass for an alert to exit the flapping state.An alert exits the flapping state when the time interval between the latest occurrence of the event and the Flap last update time of the alert reaches or exceeds the __evt\_mgmt.flap\_quiet\_interval__ property value. An alert can also exit flapping in these conditions: - When an incoming event arrives after the flap\_quiet\_interval time has elapsed. The new alert generates and its state value depends on the incoming event severity. - After a background job, which runs every five minutes, verifies that no alert updates occurred and the flap\_quiet\_interval time has elapsed. If there are no updates, the alert shows the previous state value that it had before the background job ran.

3. Click **Save**. ## What to do next You can monitor the **Event Management** > **All Alerts** list for alerts that are in the flapping state. For details, see [View alerts in the flapping state](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/t_EMViewAlertFlapping.md). **Parent Topic:**[Alert lifecycle configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/c_EMAlertRule.md) **Related topics** [Work with flapping alerts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/operator-handle-alerts-flapping.md) [View alerts in the flapping state](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/t_EMViewAlertFlapping.md)

Property	Description
evt\_mgmt.update\_alert\_restricted\_fields\_elapsed\_time	When the system receives events that do not update alerts, system fields are not updated by default. This occurs when the event data is identical to the existing alert. This helps reduce noise. For example, a "keep alive" event might be sent every few minutes from a server. This confirms that a device is still connected, even if no new data is being exchanged. This property defines the minimum time interval \(in seconds\) that must pass before an alert can be updated based on identical events. If an identical event is received within this interval, the update is suppressed to avoid generating frequent, redundant notifications. By default, the interval is set to 86,400 seconds \(24 hours\).
evt\_mgmt.flap\_interval	Flap interval, in seconds, which is the time period within which an alert enters the flapping state. An alert enters the flapping state when its current Flap Count value reaches or exceeds the given evt\_mgmt.flap\_frequency property value within the time period specified by the __evt\_mgmt.flap\_interval__ property.
evt\_mgmt.flap\_frequency	Flap frequency, frequency an alert must reoccur to enter the flapping state.
evt\_mgmt.flap\_quiet\_interval	Flap quiet interval \(in seconds\), quiet time that must pass for an alert to exit the flapping state.An alert exits the flapping state when the time interval between the latest occurrence of the event and the Flap last update time of the alert reaches or exceeds the __evt\_mgmt.flap\_quiet\_interval__ property value. An alert can also exit flapping in these conditions: - When an incoming event arrives after the flap\_quiet\_interval time has elapsed. The new alert generates and its state value depends on the incoming event severity. - After a background job, which runs every five minutes, verifies that no alert updates occurred and the flap\_quiet\_interval time has elapsed. If there are no updates, the alert shows the previous state value that it had before the background job ran.