Events that are generated by the TrueSight Infrastructure Management Server (by the three native thresholds) are called Internal events. They are marked with icons having a double wrench. The key characteristics of Internal events are:
All events that are not generated by the BMC TrueSight Infrastructure Management Server native thresholds are considered external and marked with icons having a single wrench.
|Absolute thresholds||Metrics that show unambiguous behavior such as up/down, availability, or capacity violation are good candidates for Absolute thresholds.|
|Signature thresholds||Signature thresholds are more appropriate for metrics that are more transient, such as response time, packet per second, and so on, where the data can exhibit big swings against a generally upward/downward trend.|
|PATROL thresholds||PATROL thresholds are appropriate to use for scenarios that are clear-cut, such as device availability, critical capacity overloads, and so on, which do not need to make use of advanced, server-side analytic capabilities. PATROL thresholds have the advantage of quickly triggering actionable events without having to wait for the data to be collected and passed along to the BMC TrueSight Infrastructure Management Server.|
Abnormality thresholds generate informational events when key metrics go into exceptional states. These events become useful during troubleshooting scenarios using Probably Cause Analysis (PCA), but are otherwise ignored.
By default, you do not have to do any customization for Abnormality thresholds since they have already been created for all KPIs. However, if you customize the KPI list, ensure that you create new Abnormality thresholds.
Key Performance Indicators (KPIs) are essential metrics for monitoring an infrastructure. They have a direct impact on whether or not baseline computation takes place for corresponding metrics. The following figures show how KPIs may affect baseline generation where the checked boxes indicate that baseline generation gets carried out for those combinations.
When KPI mode is active (Baseline only for KPI) – Infrastructure Management 8.6, 9.0
Have Abnormality Thresholds
No Abnormality Thresholds
When KPI mode is not active (Baseline for all metrics) – Infrastructure Management 8.6, 9.0
Have Abnormality Thresholds
No Abnormality Thresholds
In order to function correctly, Abnormality and Signature thresholds require baseline data. Due to this requirement, you may face support issues as certain thresholds would not work. In such cases, ensure that you verify that the baseline is being generated for the metrics in question.
The TrueSight Infrastructure Management Server automatically computes three different types of baselines (Hourly, Daily, and Weekly) to be used by the thresholds. In most cases, when defining thresholds, it is adequate to use Auto Baseline, where the TrueSight Infrastructure Management Server determines the best type of baseline to use for any given metric.
However, if it is known that certain metrics have clear, repeatable hourly patterns (for example, 10 AM on Tuesday behaves in the same way as 10 AM on Wednesday), then you can select Hourly Baseline as the baseline type to use for those corresponding thresholds. Similarly, Daily and Weekly baselines can be used by thresholds if you know that their metrics behave accordingly.
This feature is useful for infrastructures that have recurring periods where (part of) the infrastructure behaves very differently and that they do not want these behaviors to be factored into the normal baselines. Example: Cases where you have a major back-up on the last Friday of every month, financial number crunching at the end of every quarter, and so on.
In order for Seasonality baselines to work properly, the Infrastructure Management administrator must ensure that the baseline retention period properly reflects the special recurring period. For example, if the recurring period is twelve-month long, the baseline retention period has to be just as long.
Contact BMC Customer Support when retention periods are extended, as they can severely degrade Infrastructure Management's system performance.
Thresholds are data-driven – the more available data points, the sooner thresholds can generate some events, especially those that make use of baselines. However, frequent polling intervals will increase the TrueSight Infrastructure Management Server's system load.
When creating a Signature threshold, it is desirable to fine-tune the behavior of the threshold. As shown in the following image, there are four additional fields that become visible when you select the advanced view when creating Signature thresholds.
The field descriptions are:
Description and usage
Minimum Sampling Window
The minimum span of time, as marked by collected data points, required in order for the Signature threshold engine to initiate evaluation.
Specified if you do not want an algorithm to trigger on trivial conditions. For example, if the baseline is low (around 3% - 5%), specify a high threshold value so that Signature thresholds will only trigger if data values are higher than 80% and surpassing baseline.
Use this section to expand the baseline value range; typically, to reduce the sensitivity of the Signature threshold.
The Prediction feature gives early warnings of certain exceptional situations and is used to issue warnings if there is an aggressive trend towards the threshold. While it can be used in a wide number of scenarios, it is most effective in capacity-type scenarios, especially for those metrics which exhibit clear hourly patterns.
Some of the points to remember when using this feature include:
pw threshold checkpoint command to save states of threshold while customizing deployment.