TrueSight Infrastructure Management uses a combination of Key Performance Indicators (KPIs), Threshold types, and Baselines to determine when to send an event to the TrueSight console. Events can belong to one of the following severity levels: Critical, Major, Minor, or Informational. The severity of the event is determined by the administrator when thresholds are set and should correlate to the severity of the problem or impending problem. For details on event severities, see Understanding Event Severity.
There are three types of server thresholds that are native to the TrueSight Infrastructure Management Server: Absolute, Signature, and Abnormality thresholds.
Absolute thresholds are a simple and static set of thresholds that represent an absolute value above or below which an event is generated. In general, an absolute threshold is specified for attributes that have commonly accepted values, beyond which performance is known to degrade. Absolute thresholds are better suited for attributes that change status. For example, if the total CPU utilization of a Windows system is greater than 80%, performance degradation can occur. In this case, you can specify an absolute threshold of 80% for this attribute.
Signature thresholds are dynamic thresholds based on seasonal behavior. A set of low and high baselines are automatically generated and therefore, users do not need to manually set a threshold value. Because of this, it is a much more scalable approach in managing thresholds.
Signature thresholds allow you to control the number of events generated by a monitor. They are used to set the minimum deviation from the high and low baseline, established by Infrastructure Management Server for a monitor whose overall baseline is considered too low. Signature thresholds are better suited for attributes that degrade over time, such as as performance metrics such as response time, utilization, errors for network devices, LANs, WANs, servers, and network application services. In case no signature threshold is enabled by the user, TrueSight Infrastructure Management uses the default values to generate events.
Abnormality thresholds are similar to Signature thresholds. However, instead of regular events, a set of abnormality events are generated. The abnormality events are utilized by Probable Cause Analysis correlation. Abnormality thresholds are automatically set (out-of-the-box) on all metrics. Therefore, you do not need to do anything to start seeing the value of the abnormalities in the context of Probable Cause Analysis correlation. Abnormalities used in the Probable Cause Analysis are automatically closed when the generating condition no longer exists.
Key Performance Indicators (KPIs) are essential metrics for monitoring your infrastructure, and have a direct impact on whether or not baseline computation takes place for corresponding metrics. These parameter values are set in the application class of the monitor types. Most application classes have one or two parameters that are KPIs for the application.
The KPIs cannot be directly modified from the TrueSight console. To configure an attribute to be a KPI, you must use the administrator console. From the Tools menu, choose KPI Administration and enable the attribute to be a KPI.
Defining baselines enables you to fine tune thresholds and to introduce intelligent behavior patterns. Over time, setting baselines limits the generation of false events. Intelligent behavior is built by setting baselines, which allows for acceptable deviations in system or application performance during the peak times. Having the baseline in the trigger condition allows a threshold to generate events based on learned behavior.
Different monitor attributes have different data patterns. For example, for monitor attributes that frequently change, such as CPU usage, a data pattern captured at hourly intervals may be the best way of establishing a baseline. Hourly baselines represent a smaller number of data points and will have a tighter range, which is best suited for capturing frequent changes. Other monitor attributes, such as disk utilization, do not change as frequently. Fewer data points are required to establish a baseline for these attributes, so a daily or weekly baseline might be the best way to capture and identify changes in these attributes.
The the following baseline patterns are available in the global thresholds view:
By default, the auto baseline feature is enabled for new installations, and out-of-the-box thresholds have the auto baseline option set.
When upgrading the product, the auto baseline feature is enabled, but you must manually set a threshold with the auto baseline option.