Server thresholds, KPIs, and baselines
TrueSight Infrastructure Management uses a combination of Key Performance Indicators (KPIs), Threshold types, and Baselines to determine when to send an event to the TrueSight console. Events can belong to one of the following severity levels: Critical, Major, Minor, or Informational. The severity of the event is determined by the administrator when thresholds are set and should correlate to the severity of the problem or impending problem. For details on event severities, see Understanding Event Severity.
Types of server thresholds
There are three types of server thresholds that are native to the TrueSight Infrastructure Management Server: Absolute, Signature, and Abnormality thresholds.
| Threshold type | Description |
|---|---|
| Absolute threshold | Absolute thresholds are a simple and static set of thresholds that represent an absolute value above or below which an event is generated. In general, an absolute threshold is specified for attributes that have commonly accepted values, beyond which performance is known to degrade. Absolute thresholds are better suited for attributes that change status. For example, if the total CPU utilization of a Windows system is greater than 80%, performance degradation can occur. In this case, you can specify an absolute threshold of 80% for this attribute.
|
| Signature threshold | Signature thresholds are dynamic thresholds based on seasonal behavior. A set of low and high baselines are automatically generated and therefore, users do not need to manually set a threshold value. Because of this, it is a much more scalable approach in managing thresholds. Signature thresholds allow you to control the number of events generated by a monitor. They are used to set the minimum deviation from the high and low baseline, established by Infrastructure Management Server for a monitor whose overall baseline is considered too low. Signature thresholds are better suited for attributes that degrade over time, such as as performance metrics such as response time, utilization, errors for network devices, LANs, WANs, servers, and network application services. In case no signature threshold is enabled by the user, TrueSight Infrastructure Management uses the default values to generate events.
|
| Abnormality thresholds | Abnormality thresholds are similar to Signature thresholds. However, instead of regular events, a set of abnormality events are generated. The abnormality events are utilized by Probable Cause Analysis correlation. Abnormality thresholds are automatically set (out-of-the-box) on all metrics. Therefore, you do not need to do anything to start seeing the value of the abnormalities in the context of Probable Cause Analysis correlation. Abnormalities used in the Probable Cause Analysis are automatically closed when the generating condition no longer exists.
|
KPIs
Key Performance Indicators (KPIs) are essential metrics for monitoring your infrastructure, and have a direct impact on whether or not baseline computation takes place for corresponding metrics. These parameter values are set in the application class of the monitor types. Most application classes have one or two parameters that are KPIs for the application.
Note:
The KPIs cannot be directly modified from the TrueSight console. To configure an attribute to be a KPI, you must use the administrator console. From the Tools menu, choose KPI Administration and enable the attribute to be a KPI.
Baseline generation requirements
Defining baselines enables you to fine tune thresholds and to introduce intelligent behavior patterns. Over time, setting baselines limits the generation of false events. Intelligent behavior is built by setting baselines, which allows for acceptable deviations in system or application performance during the peak times. Having the baseline in the trigger condition allows a threshold to generate events based on learned behavior.
Different monitor attributes have different data patterns. For example, for monitor attributes that frequently change, such as CPU usage, a data pattern captured at hourly intervals may be the best way of establishing a baseline. Hourly baselines represent a smaller number of data points and will have a tighter range, which is best suited for capturing frequent changes. Other monitor attributes, such as disk utilization, do not change as frequently. Fewer data points are required to establish a baseline for these attributes, so a daily or weekly baseline might be the best way to capture and identify changes in these attributes.
The the following baseline patterns are available in the global thresholds view:
- Auto baseline—The Auto baseline analysis engine automatically detects an abnormality in any monitor instance attribute and determines the best baseline to be used depending on the behavior of the monitor instance.
By default, the auto baseline feature is enabled for new installations, and out-of-the-box thresholds have the auto baseline option set.
When upgrading the product, the auto baseline feature is enabled, but you must manually set a threshold with the auto baseline option.
- Hourly baseline—Each hour of the day has a high or low value that is tracked. The pattern for the specified metric is tracked on an hourly basis, and this pattern is repeated for each day. An hourly baseline is initialized after the monitor instance is created and 24 hours of data collection has occurred.
- Daily baseline—A high or low value is derived from the moving average of each consecutive day. This high or low range is taken from a larger number of data values and hence, falls in a wider range than the hourly. A daily baseline is initialized after the monitor instance is created and 24 hours of data collection has occurred.
- Weekly baseline—The baseline is calculated daily from Monday to Friday. All these days share the same 24-hour baseline. A weekly baseline is initialized after the monitor instance is created and 168 hours of data collection has occurred.
- Hourly and Daily Baseline - This baseline is a combination of Hourly and Daily Baselines.
- Weekend Pattern—You can customize your baseline to calculate separately for the weekend - For example, Saturday and Sunday. These two days share the same 24-hour baseline.
- Seasonal Pattern—You can customize your baseline to calculate separately for pre-determined days when your business experiences out-of-the-ordinary workloads or other special behavior. For example, a year-end or festival sale.
Comments
Log in or register to comment.