Creating Threshold Profile
Thresholds let you define the status of an attribute based on specific conditions. A threshold is a predefined set of values associated to an attribute, based on which an Alarm can be generated. For example, you can define a threshold to show the status of the webserver as critical, if the response time exceeds 100 seconds. Likewise, you can define a threshold to show the status as clear, if the MBean's attribute - Active is equal to true.
To define a threshold, follow the steps given below:
- Click New Threshold. This opens the Create New Threshold Profile screen.
- You can create new Threshold Profiles for Numeric, String or Float values. Select the value type from the New Threshold Profile drop-down menu.
- Select the Threshold Profile Type : Standard or Adaptive.
- Threshold Profile Type – You can select if you are creating a profile for Standard or Adaptive Thresholds:
- Standard Thresholds - You can set the profile for Critical, Warning or Clear severity with two conditions supported for every severity.
- Adaptive Thresholds - Adaptive threshold has two categories - 'Automatic' and 'Manual':
- Automatic: You can set the deviation percentage for the alert raised.
- Manual:This can be categorized as:
- Baseline: You can set a fixed Baseline Date Range from the drop-down menu. Check the checkbox to specify Baseline as %. If the box is unchecked, you can enter hard-coded values instead of the percentage.
- Custom expression: Users can define their own expression from the available system options provided by the Applications Manager. Here are the Available System Variables:
Use this option for Expressions | Description |
$10D_MVA |
Ten Days Moving Average |
$30D_MVA |
Thirty Days Moving Average |
$6H_MVA |
Six Hours Moving Average |
$7D_MVA |
Seven Days Moving Average |
$LastHourValue |
Last Hour Average |
$10H_MVA |
Ten Hours Moving Average |
- Specify the Threshold Name.
- Configure the threshold for Critical, Warning or Clear severity. You can configure the threshold for Warning and Clear severity by enabling the Show Advanced Options checkbox.
- Now specify the conditions for the Critical, Warning or Clear severity. We provide two condition support for every severity when creating Threshold Profiles. You can set the monitored value of a particular severity to be > (greater than), < (lesser than), = (equal to), != (not equal to), <= (lesser than or equal to), >= (greater than or equal to) to a customizable Threshold Limit. You can set additional condition when defining your threshold limit for each severity by clicking on the More link at the right-hand corner of the Create New Threshold Profile table.
Note:
- When creating a threshold for multiple strings, separate the values with commas. Ensure there are no spaces between a comma and a value.
- While configuring threshold condition for all the severities, ensure that all values within the threshold's start and end points are considered. The threshold should be set in a way that the specified values are mapped and unique based on the conditions used for all the severities.
- For example, if the value collected for the response time attribute of a Windows server monitor is 100 and the thresholds condition configured for that attribute is Critical > 50, Warning = 50, Clear < 50, then the condition matches for the Critical severity alone, whereas, it does not satisfy the conditions for Warning and Clear severities. As a result, only Critical alarm is generated for that attribute.
- You can also specify a message that has to be appended to the alarm. By default, you can configure Critical severity, By clicking on advanced, you can configure Warning and Clear severity.
- Specify the number of polls that can be scheduled before reporting an error. If you do not want to generate an alarm for the very first time the threshold condition is crossed, you can set Applications Manager to examine a certain X number of polls from a Y number of consecutive polls (both numbers are customizable), before generating an alarm. For e.g., If you want an email alarm to be generated only if the CPU Disk utilization is above 100%, consecutively for more than three polls out of five polls, then you can configure the number of polls to be examined out of a number consecutive polls before generating an alarm. By default, it takes the value from Global Settings. Refer Configuring Consecutive Polls for setting configurations for individual monitors.
Note: In the case of Automatic Adaptive profiles:
- Alarms will only get raised when the same severity occurs consecutively.
- Globally configured settings will not be applied
- If you wish to apply the threshold only during specific time periods in a day/week, enable the Apply Threshold based on Business Hours option and select the Business Hour during which the threshold has to be applied.
- Click Create Threshold Profile to add the threshold after defining all the conditions.
- Choose the View Threshold option available on the top menu to view the threshold. The Threshold Profile screen lists all the default thresholds and newly created thresholds. Note: You can also edit the threshold created using the edit ( ) icon.
The thresholds thus defined can be associated with the attributes for determining the status of the attributes of the Monitor Group. You can also associate thresholds and actions directly through Global Alarm Configuration instead of the individual Monitor screen.
Adaptive Thresholds
You can use New Threshold Profiles to apply Adaptive thresholds broadly across targets within your environment. For a Standard Threshold Profile, raw data will be assessed to the threshold limit and alert will be generated in every poll. For Anomaly Threshold Profiles, hourly average data is compared with the past archived data (this should be configured by the user). Adaptive thresholds are a combination of both standard and anomaly thresholds and has two categories - Auto and Manual.
Auto Adaptive Thresholds
Applications Manager allows you to configure alarms by associating thresholds based on anomaly detection with the help of Machine Learning. It makes use of RPCA algorithm to determine the anomaly which helps in identifying sudden or unusual spikes in the data immediately upon occurrence and triggers alerts accordingly.
Once an Auto-Adaptive profile is configured, a history of data is collected for the attribute of the monitor to understand its characteristic and behavior. After a few hours of data collection, it is compared with the current data to check abnormalities;if any and then an alarm is raised in case of anomalies.
If an abnormal value is detected for the attribute, with it's deviation violating the threshold, then alerts will be generated and the anomaly details will be shown in the attribute's RCA message. The RCA message will contain the anomaly details of the attribute that caused the alarm, by displaying the amount of deviation found between the expected and actual values. If the collected value does not have any anomalies or the deviation does not meet 'Critical' or 'Warning' threshold, then the alarms will be cleared with 'Clear' severity.
Note: Machine Learning based anomaly detection is applicable only to Numeric attributesand does not support the following attributes:
- Health
- Availability
- String attributes
- Configuration Numeric attributes
- Configuration String attributes
Manual Adaptive Thresholds - Baseline and Custom expression
Adaptive Baseline Threshold compares raw data values with past archived data at every poll. Adaptive Custom Expression contains some configured expressions (Need to configure by the user from UI) and it calculates the value for that expression and compares it with raw data at every poll.
|
Refer to Associating Threshold and Action with Attributes for more details.
Threshold & Action Profile CSV
Applications Manager gives you the ability to create a Threshold & Action profile report in .csv format. This report shows the threshold creation time, Monitor Group, Type, Threshold Profile, Threshold Status, Critical, Warning, and Clear Actions and more for catagorized and uncatagorized monitors. Here's how you can create the report:
- Click on View Threshold Profiles under the Threshold Profiles tab.
- Click the Threshold & Action Profile CSV button at the right- corner of the Threshold Details page.
- Select the checkbox for the kind of thresholds you want to create a report for. You can create a report for all thresholds, particular groups or disassociated monitors alone.
- Click Create CSV.
- A notification appears at the top of the page informing you that the "Threshold & Action profile report was successfully created. Download"
- Click download to download the CSV file.
Threshold Profiles in the Enterprise Edition
You can create Threshold Profiles from the Admin Server in Applications Manager, the same as in the Professional Edition, and the profiles created automatically sync with the Managed Servers. However, these profiles can only be used and cannot be edited from the Managed Servers.