Configuring variate policies

Configure variate polices for real-time anomaly detection of various metrics that dynamically change with time.

The following video (4:30) created by BMC Customer Support describes how to create a variate policy.

 https://youtu.be/tDNDQz7FegU

To create a variate policy

On the Configuration > Multivariate Policies page, click Create, and do the following:

1. Specify a unique name and an optional description.

2. Specify the anomaly settings.

   Constructing the metric selection criteria

   1. Click Add Metrics and specify the metric selection criteria.
      
      When you click in the box, you are prompted to make a selection. Each time you make a selection, you are progressively prompted to make another selection. 
      
      The selection criteria consists of opening parenthesis, followed by the slot name, the operator, the slot value (which can be a string based on the type of slot selected), and the closing parenthesis. You can optionally select the logical operator AND to add additional conditions. Specifying the opening and closing parentheses is optional.
      
      Example criteria: If you specify the the following criteria, all the Device with name equal to "pun" and Device with name equal to "ent_pun", all the metrics from this query is listed.
      
      The green tick mark indicates that the event selection criteria syntax is correct.
      
   2. From the list of metrics, search for the metrics and click Add to move the metrics under the Selected Metrics section.
      Important: For a policy having more than 10 metrics, the BMC Helix Operations Management considers only those metrics with scores in the top 10 ranks for the overall anomaly score calculations. All other metrics with scores outside of the top 10 ranks are ignored. For a detailed example, see Viewing-anomaly-events.
   3. Click Apply to save the selected metrics.
   4. Click Anomaly Settings and expand.

   5. (Optional) Specify the anomaly event settings.

      
      

      • Anomaly Duration -Time limit to generate an anomaly event. An anomaly event is generated only if the anomalous data point persists for the duration selected. By default, it is set to 5 minutes.

        For example, if the duration is set as 10 minutes, the policy generates an anomaly event only if the anomalous data point persists for a minimum of 10 minutes. Every successive duration of 10 minutes can be considered as a moving window. If you have configured a 10 minutes duration, 0 to 10 minutes, 1 to 11 minutes, 2 to 12 minutes, and so on are successive moving windows of duration.

      • Message Text - Text to be used in the anomaly event field of the selected metrics.
      • Auto Close - Selecting this closes the anomaly event automatically if the anomaly condition no longer exists for the selected metrics. By default, it is selected. If you choose not to enable this option, you need to close the event manually.

   6. (Optional) Specify the lower range standard deviation values for each severity type.

      

      • Severity - Supported anomaly event severity types. Minor, Major, and Critical. These are non-editable.

      • Variability Range (Sigma) - The standard deviation value to define the range for each severity type. By default, the is set to 1, 2, and 3.5. Score value in the range between 1 and 2 is Minor, 2 and 3.5 is Major, and above 3.5 is Critical. You can configure these values as per your organization requirements. For more information on severity and anomaly events, see Variate-Policies.
        

        Note: BMC recommends that you do not change the default standard deviation settings unless you are familiar with this concept and know your organizational requirements.

3. Save the variate policy.

   When do I start seeing the anomaly events?
   Only after the unsupervised algorithm has completed its learning phase. However, BMC Helix Operations Management is built with a robust mechanism to look for existing historical data points for the selected metrics immediately after you create a variate policy.

   - If there are enough number of data points, you can see the anomalies in a short time.

   - If there are not enough data points, the BMC Helix Operations Management needs some time to collect the minimum of 320 data points required data points for a multivariate configuration before you could see the anomalies.

Event policies do not apply to anomaly events that are generated by multivariate policies.

To view the list of variate policies

On the Configuration > Variate Policies page, view the list of variate policies.

By default, the policies are sorted by Last Updated time in a descending order. To sort on a different column, click the column heading. 

To edit a variate policy

On the Configuration > Multivariate Policies page:

1. Do one of the following:
   
   • Select the variate policy and click Edit.
   • From the Actions menu of a variate policy, select Edit.
2. Change the configuration details provided while creating the variate policy and click Save.

To delete a variate policy

On the Configuration > Multivariate Policies page:

Do one of the following:

• Select one or more variate policies and click Delete.
• From the Actions menu of a policy, select Delete, and click Yes.