ManageEngine® Applications Manager Chapter 12. Anamoly Profile
|
||
Using Anomaly profile, you can be forewarned about events that don't confirm to previously reported best data.
How Anomaly Profile Works?
Anomaly Profile can be created based on
Baseline Values
Custom Expressions.
Baseline Values:
Anomaly happens when the current set of values don't conform to the baseline range values. Current Attribute values are compared against the reported data in a particular week [baseline week].
Define baseline - a week where the system has performed very well [there has been less number of alerts] will be chosen as reference/ baseline data range. After choosing the week for baseline comparison, then each day's value will be compared with the corresponding day of the baseline week. For eg. If you choose week 1 of August as baseline week, then every Monday's data will be compared with August week1's Monday values.
Specify the anomaly criteria - Set the upper limit and lower limit range to compare the current data with the baseline values.
Working - After comparing with the baseline data, if the current value does not come between the upper limit and lower limit configured, then alarms will be generated.
Lets set Aug 1st week of 2009 as the baseline data range.
Anomaly range is defined as 10% upper limit and 10% lower limit.
The deviation is calculated based on hourly values. So at 11 A.M, Tuesday of the Second Week, the Memory Utilization value will be compared with the values present at 11 AM, Tuesday of the Ist week. If the value deviates from the upper limit or lower limit, then an alarm will be generated.
Creating Anomaly Profile based on Baseline values
Click on Anomaly Profile link. Click on New Profile
In the Anomaly profile page, Give the Name for the new Anomaly profile you want to create.
For baseline calculation, select the Baseline date range: You can choose between fixed baseline value [the appropriate week] or moving baseline value which is based on previous week's data.
Define the allowed deviation from baseline. Alarm can be generated either based on percentage of upper limit, lower limit value or straightaway hard coded comparison values. The generated Alarm will be cleared if the value falls in the baseline range that is checked for every hour. Alarm can be critical or warning. For both the limits, if you do not want alarms to be generated, select 'No' option; You will be provided with just an EMail action.
Select the comparison method.
The recommended method would be to Compare last hour value directly with baseline value. Here, While comparing, hourly value will be taken into consideration and compared with the baseline value directly.For eg: Say if current time is 10:00 AM , Monday and if baseline date range is week 2. Then week 2 , Monday 10:00 AM value will be taken for comparison and upper and lower limits will be applied as per the user configuration.
The other method would be to Compare values based on the corresponding difference with the previous hour. While comparing, the corresponding difference in hourly values would be taken into consideration.
For eg: If current time is 10:00 AM, we will take the difference between the values at 10:00 AM and 9:00 AM for comparison. A similar approach will be used for getting the baseline values.
Finally click 'Create Anomaly profile'
Custom Expressions
Anomaly is detected when current data doesn't confirm to the rules based on system variables. For eg., You can create a rule like Anomaly is to be detected when the current Last Hour Average Value is greater than twice the Six Hours Moving Average Value. Critical and Warning alarms can be set accordingly. Currently, the system variables that can be used for forming custom expressions are
Expressions | Meaning |
$10D_MVA | Ten Days Moving Average |
$LastHourValue | Last Hour Average |
$6H_MVA | Six Hours Moving Average |
$30D_MVA | Thirty Days Moving Average |
$10H_MVA | Ten Hours Moving Average |
$7D_MVA | Seven Days Moving Average |
Associating Anomaly profile
Go to the respective monitor details page. Choose the attributes for which you want to configure alarms. Click on Configure Alarms
Threshold Details and Anomaly Details will be listed. Click on Anomaly Details
From the drop down box, Choose the appropriate attributes and associate them to the corresponding anomaly profiles.
Save the alarm configuration
Anomaly Dashboard
If the health of any attribute has turned critical or if the availability is down, click on the icon for seeing the root cause analysis.
Click on Use Anomaly dashboard for troubleshooting to access the Anomaly Dashboard.
Manager Console |
Support & Product Info |