How abnormalities are generated
Abnormalities are generated when the data values from a monitor fall outside of the normal baseline range for a statistically significant number of points within the sample window specified in the signature threshold.
The abnormalities generated have a severity field, which records which baseline was exceeded for a significant number of points (helping determine the severity of the abnormality). Generally, abnormalities that exceed Weekly baseline are more serious in nature than ones that exceed Daily baseline, and abnormalities that exceed Daily baseline are more serious in nature than ones that exceed Hourly baseline.
By default, if no signature threshold is set, abnormalities are still generated. A minimum of five data points are required. If the sample window is set too small (sample window is set in time duration), the algorithm automatically waits for five data points to come in. For example, if you set a sample window to 10 minutes on a specific monitor attribute but the polling rate of that monitor is 5 minutes, 25 minutes must pass before an abnormality is generated. For this reason, it is better to use lower polling rates for monitors.
Abnormalities are closed when the number of data points exceeded in the last window sample size is not considered significant. For example, if six out of seven data points falling out of range is statistically significant, then as soon as the last exceeded points drop to five out of seven points, the abnormality is closed.
By default, even if no explicit global or instance signature threshold is set, Infrastructure Management generates abnormalities for the previously mentioned baseline conditions.