CPU Alert with normal peak usage exclusions

raymondakrawi

I have recently recreated my CPU and Memory alerts using a SWQL query in order to standardize the conditions across my 3 different instances. The new alerts are being sent to a operations group and they aren't happy with the reoccurring cpu and memory alerts whether it is during high peak usage hours or whether a backup or a/v scan.

I am testing the option of creating new custom properties cpuPeakStart and cpuPeakEnd for cpuloads and memPeakStart and memPeakEnd. In my swql query I will add an additional where condition similar to the one listed below.

where

hour(DATETIME) > 5

and

hour(DATETIME)  < 8

Has anyone tried this approach or have any other alternatives to handling high reoccurring kpi utilizations?

Another approach would be to unmange the node but that puts us at risk if a node goes down and no alerts get triggered.

mesverrum

What is the expected procedure if these devices are using high CPU? 

Is there a scenario that would actually require an intervention for these boxes?

To me it sounds like no action is considered necessary if you don't care during peak hours, and you don't care during off hours then when would it ever actually matter? You could just come up with a scheme to exclude these devices from CPU alerting in general.  Assuming you have SAM or some other form of application monitoring in place, maybe it would be more effective to just alert on some kind of synthetic transaction against the application this server supports and just rely on that since ultimately CPU load is just an indirect measure that we normally associate with slow application performance.