Autoanomalies

The following image illustrates the benefits of enabling automatic anomaly detection versus disabling it:

As an administrator, configure the system to automatically generate anomaly events with a specific severity when a metric violates all baselines and breaches a deviation value in sigma. The baseline of a metric is calculated based on the historical data collected over time.

Configure automatic anomaly event generation for key performance indicators (KPIs) or all performance metrics with fewer manual configurations. Performance metrics monitor the health and performance of a specific device or service.

Performance metrics are a superset that consists of both KPI and non-KPI metrics. For example, the Idle Time (%) of a CPU is a performance metric, and KPI: Utilization (%) of a CPU is a KPI metric.

Metrics are marked as KPIs at the monitoring solutions or Knowledge Module (KM) levels. To learn more about performance and KPI metrics, see Monitoring solutions in BMC Helix Operations Management.

How are the hourly, daily, weekly, and monthly baselines computed

BMC Helix Operations Managementuses historical data, including performance metrics, to calculate baselines on an hourly, daily, weekly, and monthly basis. Baseline values are calculated by using the minimum-maximum algorithm. The high baseline value is calculated by using 85% of the maximum value, while the low baseline value is calculated by using 15% of the minimum value. An autoanomaly event is generated when a data point breaches all baselines—hourly, daily, weekly, and monthly​. This minimizes the event noise created by autoanomaly events.

The following table provides details about the baselines and how they are calculated.

The following graph shows hourly, daily, weekly, and monthly baselines in different colors with corresponding high and low data point values:

How is an anomaly detected

BMC Helix Operations Management collects the values for a monitor's attributes and performance metrics over a specific time. Historical data is used to determine low and high baseline values for a metric. Baseline calculation begins after six hours of aggregate data is available for a metric.

Anomaly events are automatically generated after a specific duration lapse for the following violations:

• Baseline violation
• Deviation violation

To learn about how sigma deviation works, see Variate-Policies. The anomaly event is automatically closed when the metric value returns to a normal state.

In the following example, an anomaly event generated only when the Traffic_out metric in a network violates the following parameters:

• Metric baseline (High baseline: 14663.847)
• Sigma (3)
  The system waits until the metric deviates for 3 sigma before it generates the anomaly.
• Duration (6 minutes)
  The system waits for 6 minutes before it generates the anomaly.

The anomaly event is automatically closed when the CPU utilization returns to a normal state.

Out-of-the-box metrics for autoanomalies

The following types of KPI metrics are available out-of-the-box to raise only high baseline events by default:

• Metrics that allow baseline configuration
• Range-bound metrics with out-of-the-box dynamic thresholds

Metrics that allow baseline configuration

This section provides a list of KPI metrics that allow baseline configuration. To configure the baseline for these metrics, use the Manage Metrics link on the Manage Auto Anomaly page. For more information, see Configuring autoanomaly event generation.

Range-bound metrics with out-of-the-box dynamic thresholds

These KPI metrics range between 0 and 100. They are configured to generate anomaly events for high baseline violations only. Even if a low baseline is violated for the metrics, an anomaly event is not generated. You cannot configure baselines for these metrics.

To generate an anomaly event for these metrics, both the following conditions must be satisfied:

• The high baseline is violated.
• The out-of-the-box dynamic threshold is violated.

Example

Apex Global uses BMC Helix Operations Management, which is configured to generate anomaly events for the CPU utilization metric. In this case, an anomaly event is generated in BMC Helix Operations Management only if both the following conditions are satisfied:

• The CPU utilization crosses the high baseline, which is determined by the anomaly detection algorithm.
• The CPU utilization crosses 65%, which is the out-of-the-box threshold for this metric. 

In this case, Apex Global cannot change the out-of-the-box threshold for the metric.