baseline_engine standard deviation algorithm

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

baseline_engine does the work of creating alarms for other probes such as snmpcollector.  When a user configures an snmpcollector alarm with a standard deviation, (or any other threshold), the configuration is actually sent to the baseline_engine which monitors QoS and creates the alarms. How does Baseline Engine use the Standard Deviation threshold configuration?

Environment

Release: DX UIM 20.4*/ 23.4
Component: Baseline Engine

Resolution

The algorithm for baseline_engine is as follows:
(threshold_value * standard_deviation) + baseline

The number provided by the user should be the number of standard deviations from the baseline after which they want to alarm. For extremely uniform datasets with low standard deviations, this could potentially cause problems in which alarms are generated by very small deviations from the baseline.

For example, if the dataset was for a fairly uniform internal ping, something like [55, 55, 55, 55, 55, 55, 55, 55, 54, 55, 55, 55, 55, 54, 55, 55, 55, 55, 55, 55, 55, 56, 55, 55], the standard deviation would be something on the order of 0.35. So, if the user put the number “10” in for the number of standard deviations from the mean, we would calculate a dynamic threshold using our algorithm:
(10 * 0.35) + 54.95 = 58.45

So if a ping came in that was 59 ms, something really not that far off from 55, it would still alarm because the nature of the data set creates such a small standard deviation that 59 is 10 standard deviations away from the mean.

Since this algorithm is dynamic, based on the data set some customers have received alarms that they did not expect.  If a user doesn’t have a business need for using standard deviation, we would encourage them to choose a threshold by Percent instead.