Flapping

Flapping, etc. (TODO: lots more explanation & background)

cf. docstring for count_flaps()

class dashboard.correlation.endpoints.flapping.FlapBucket(events)

Bases: object

A collection of EndpointEvent instances, sorted by time, with all down events preceding all up events.

Events are assumed to be sorted by time.

And the events should not be an arbitrary, rather created as described in create_flap_buckets().

Parameters:

events – an iterable of EndpointEvent instances, assumed to be already sorted by time

compress()

discard unnecessary events from this bucket, keeping at most:

  • the first & last 2 consecutive down events

  • the first & last 2 consecutive up events

property down_time

Return the seen timestamp of the first down event.

Note: we allow FlapBuckets which contain no down events, but these are not written to the database (cf. save_if_dirty())

save_if_dirty(session, endpoint, alarm_changed=False)
Parameters:

  • session

  • endpoint

  • alarm_changed – True if dashboard_alarm_id needs to be updated

Returns:

property up_time
dashboard.correlation.endpoints.flapping.create_event_history(events=None)

Utility for creating a standard event_history iterable object.

This method is used to create an instances that can be saved as an event_history attribute.

note: this might need to be an EndpointEvent method if subclasses need a different type.

Parameters:

events – an iterable of EndpointEvent instances

Returns:

a SortedList instance, containing all input events, sorted by _cmp_events()

dashboard.correlation.endpoints.flapping.create_flap_buckets(events)

Group sorted_events into buckets, each of which is a flap.

i.e. the first event in each bucket is down, followed by zero or more down events (until there is an up event, or the end of the input list is reached), then zero or more up events (until there is a down event, or the end of the input list is reached)

Parameters:

events – a normal sorted list of events

Returns:

an iterable of FlapBucket instances, as described above

dashboard.correlation.endpoints.flapping._cmp_events(event_a, event_b)

If the difference in seen timestamps between 2 traps is more than REBOOT_THRESHOLD_S (or if the traps come from different equipment), use the seen time to compare the order of traps.

Otherwise compare the system up times.

Parameters:

  • event_a – an EndpointEvent instance

  • event_b – an EndpointEvent instance

Returns:

-1, 0, or 1 as per a normal Posix cmp function