Setting threshold using baseline

Baseline Threshold Macros

The baseline threshold macros can only be used when editing an application or a template. These macros cannot be used in alerts.

Notes:

${USE_BASELINE} cannot be used with math functions. To have this information available for use as Warning and Critical thresholds, replace ${USE_BASELINE} with the following formulas:

• Warning: ${MEAN} + 2 * ${STD_DEV} (or ${MEAN} - 2 * ${STD_DEV})
• Critical: ${MEAN} + 3 * ${STD_DEV} (or ${MEAN} - 3 * ${STD_DEV})

Hi Vinay

How cool was that answer!

Thanks a ton. This is precisely what I was looking for.

vinay.by​, this is excellent and exactly what we want to do.  can you talk a little about what these formulas are actually doing?  Maybe it's obvious and I'm just missing it...  Say for example I wanted to use the base line and pad it a bit by 10 to 20%.  How would I achieve that using the above formulas?

The math presented represents the statistical percentages of 95% and 99.7% of all samples fall within those values respectively.

So if you want to extend those in either direction by 10% then you just do more math - Warning: ((${MEAN} + 2 * ${STD_DEV})*1.05) OR ((${MEAN} - 2 * ${STD_DEV})*0.95) and Critical: ((${MEAN} + 3 * ${STD_DEV})*1.10) OR ((${MEAN} - 3 * ${STD_DEV})*0.90) this would make the upper and lower limits 10%. For example if for warning the values were 70 and 90 they would convert to 63 and 99, that gives you 10% up and down. Not sure what that gets you though when you are using dynamic numbers like this.

Thanks for your reply.  Yea I'm not sure this is the best approach either and we ended up scraping baselining anyway.  We have 14 exchange servers to monitor and ended up deactivating base lining for the 4 templates we're using (which was an enormous chore in and of itself - 114 components * 14 was a lot of clicking... curse you baseline for breaking template inheritance!) simply because the numbers that the baseline calculated were just drastically too low.  At which point we were constantly going in to each component and recalculating the baseline which was just a gigantic pain in the behind.  This was just for 14 exchange servers and NOTHING else - I would hate to think what larger environments are like employing baseline, either I'm missing something or baselines just add more work and unnecessary complexity to thresholding.  Seems pulling a number out of thin air is just as effective, or if you're lucky, as is the case with Exchange there are good TechNet suggestions already, but that's not always the case.

Is there anyway to have the +/- a value?

Eg - Voltage on a system is 240volts, I want to warn when its +/- 5% and critical when +/- 10%

I'm probably not seeing the solution but is there any easy way to do this?

Thanks

Support have just confirmed +/- values are not currently possible to do.

I've raised a FR to add additional logic to the Warn/Critical Monitors -

For that particular case, you could establish an alert that had both conditions ORed together in the trigger condition section, but I think that's off-topic since you don't need the baselines for this particular case, you just want the two fixed offsets.