16 Replies Latest reply on Jan 13, 2016 11:42 AM by tnice81

Dynamic alert thresholds in 10.7

patriot Mar 5, 2014 2:45 PM

I have some questions about how the new dynamic alert threshold function works for nodes and interfaces.

It looks like:

1. Dynamic thresholds for nodes are calculated at the time the button is clicked on the Edit Node page and are based on the data collected for the number of days set for the Baseline Data Collection Duration. These thresholds are not calculated again unless the button is clicked again manually.

2. For interfaces, does Orion update the dynamic thresholds based on the Interface Baseline Calculation Frequency AND use the setting for the Baseline Data Collection Duration to determine how much data to use to perform the calculation?

Another way to ask the question... are Node dynamic thresholds updated manually, while interface thresholds updated automatically with a "rolling" calculation?

Thanks.

Re: Dynamic alert thresholds in 10.7

rob.hock Mar 6, 2014 6:36 PM (in response to patriot)

By default we recalculate all core/NPM thresholds every 7 days- so a "rolling window." This is defined under polling settings:
Like (0)

Actions
- Re: Dynamic alert thresholds in 10.7
  
  patriot Mar 7, 2014 9:56 AM (in response to rob.hock)
  
  So, Rob let me see if I have this straight.
  
  For nodes, the Baseline Data Collection Duration applies a rolling threshold calculation for any node for which the "Use Dynamic Baseline Thresholds" button has been pushed. Is that accurate?
  
  For interfaces, is it only the Interface Baseline Collection Frequency setting that controls how thresholds are applied for interfaces? Or, does the Baseline Data Collection Duration also figure into it?
  
  And finally, are the following statements true related to the options available for setting alert thresholds for nodes and interfaces?
  
  Option 1: Use the global thresholds listed on the Orion Thresholds and NPM Thresholds pages
  Option 2: Click the Override Orion General Thresholds and set a STATIC value for the threshold.
  Option 3: Click the Override Orion General Thresholds AND use click the Use Dynamic Baseline Thresholds button to employ "rolling thresholds"
  
  Thanks.
  
  Like (0)
  
  Actions
  - Re: Dynamic alert thresholds in 10.7
    
    rob.hock Mar 7, 2014 3:48 PM (in response to patriot)
    
    1. Yes- if you have selected the Use Dynamic baseline for either Warning or Critical thresholds a rolling threshold calculation is used
    2. Duration is how large the rolling window used for calculation is. Frequency is how often we recalculate.
    
    Options 1-3 are all correct.
    
    Like (0)
    
    Actions
    - Re: Dynamic alert thresholds in 10.7
      
      patriot Mar 7, 2014 4:06 PM (in response to rob.hock)
      
      Thanks Rob. So, just to be sure... the Baseline Data Collection Duration applies only to Nodes, correct?
      
      Like (0)
      
      Actions
      - Re: Dynamic alert thresholds in 10.7
        
        rob.hock Mar 7, 2014 4:28 PM (in response to patriot)
        
        Interfaces as well, so we would want to make sure the overall statistics retention period is greater than the calculation duration.
        
        Like (0)
        
        Actions
        
        Re: Dynamic alert thresholds in 10.7
        
        patriot Mar 18, 2014 8:47 PM (in response to rob.hock)
        
        Wait a minute I just realized something. The Frequency indicates that it applies to Interfaces. Why would one look at that and conclude that it also applies to the frequency with which Node baselines are calculated?
        
        One other questions about the Polling Settings page while I am on the subject....what kinds of data are included in the Detailed, Hourly and Daily Statistics Retention settings? NPM specifically provides separate retention settings for Interface, UnDP and wireless data, so what do those retentions apply to?
        
        Thanks.
        
        Like (0)
        
        Actions
        
        Re: Dynamic alert thresholds in 10.7
        
        patriot Mar 26, 2014 11:45 AM (in response to patriot)
        
        rob?
        
        Like (0)
        
        Actions
        
        Re: Dynamic alert thresholds in 10.7
        
        rob.hock Mar 26, 2014 7:22 PM (in response to patriot)
        
        Apologies for the delay, was out at Cisco Live ANZ last week. Good catch, that label is incorrect and actually applies to both node and interface calculation. The additional retention settings are for node statistics (availability / response time / etc.)
        
        Like (0)
        
        Actions
        
        Re: Dynamic alert thresholds in 10.7
        
        patriot Mar 27, 2014 8:47 AM (in response to rob.hock)
        
        Thanks for sticking with me on this Rob. You must admit that keeping documentation updated and accurate is not a strength of SolarWinds.
        
        So, are my notes in the following screenshot accurate?
        
        Like (0)
        
        Actions
        
        Re: Dynamic alert thresholds in 10.7
        
        rob.hock Mar 27, 2014 2:43 PM (in response to patriot)
        
        That is correct sir- thank you! I will pass this to our doc team to update.
        1 of 1 people found this helpful
        
        Like (0)
        
        Actions
        
        Re: Dynamic alert thresholds in 10.7
        
        patriot Mar 27, 2014 3:38 PM (in response to rob.hock)
        
        Thanks Rob. May I humbly suggest a re-write in terms of the terminology on this and possible other pages?
        
        Like (0)
        
        Actions
    - Re: Dynamic alert thresholds in 10.7
      
      tnice81 Jan 13, 2016 11:42 AM (in response to rob.hock)
      
      Thank you for this info. I've been looking for how to do this and your explanations led me straight to it.
      
      Like (0)
      
      Actions
Re: Dynamic alert thresholds in 10.7

scvvuuren Sep 5, 2014 7:52 AM (in response to patriot)

Hi patriot and rob.hock

I know this post is a bit old but I have a questions.

We have 10 000 + interfaces monitored, do we have to go enable baseline thresholds on each one of them or is there a way to globally enable it on all interfaces.

I would have loved to only check this on trunk ports but in Alert Manager I do not see an option to do this.
Like (0)

Actions
- Re: Dynamic alert thresholds in 10.7
  
  HolyGuacamole Sep 5, 2014 10:18 AM (in response to scvvuuren)
  
  Go to manage nodes, change the drop down to interfaces. Search and select the interfaces you are after, then click on the 'Edit Properties' and you can set dynamic thresholds for all the selected interfaces.
  
  Like (1)
  
  Actions
  - Re: Dynamic alert thresholds in 10.7
    
    scvvuuren Sep 5, 2014 2:05 PM (in response to HolyGuacamole)
    
    Thanks HolyGuacamole
    
    This is a very manual way which is ok, would have been nice though if one could globally enable all interfaces to do baseline calculations and on alerting filter it out for trunk ports as an example.
    Nevertheless this would have to do for now thanks.
    
    Like (0)
    
    Actions
Re: Dynamic alert thresholds in 10.7

jpineda Dec 3, 2014 2:11 PM (in response to patriot)

I understand this is old but my question is also about understanding dynamic threshold.

Can dynamic threshold keep track of the trend or does it just do a calculation of the history and then uses that number?

For example:
Our server's normal memory used is 70% but every night our anti-virus kicks in and uses 95%.

Thanks in advance.
Like (0)

Actions