How dynamic/static alarms with baseline works in UIM
Article ID: 142477
Updated On:
Products
Issue/Introduction
How dynamic/Static alarms with baseline works.
Environment
Release : 20.x or later
Resolution
1) Dynamic Alarms:
Baseline value is created by the qos samples collected over a period of time by baseline_engine probe.
There are three algorithms allowed for dynamic alarm thresholds:
Note: You must indicate the direction for each algorithm, either increasing or decreasing.
a) Scalar: Each threshold is a specific value from the computed baseline.
b) Percent: Each threshold is a specific percentage of the computed baseline.
c) Standard Deviation: Each threshold is a measure of the variation from the computed baseline.
A large standard deviation indicates that the data points are far from the computed baseline and a small standard deviation indicates that they are clustered closely around the computed baseline.
IF algorithm is Scaler then for each sample where the condition [Qos Value > baseline + thresholdvalue]
is true an alarm will be produced.
IF algorithm is Percent then for each sample where the condition [Qos Value > baseline % thresholdvalue]
is true an alarm will be produced.
2) Static Alarms:
There is no Baseline for this case.For each sample that is probe fetches alarm condition is evaluated.
For Example :
If Threshhold = 8 ; current Qos value 10 ; Operator used '>'
Then for each sample where the condition [Qos Value > Threshold] is true an alarm will be produced.
In the CSV, there are many samples where value is greater then 2.5, therefore you will get alarms for each sample which evaluate to true.
------------------------------------
Baseline Calculation Example:
For Baseline is set to 2.5 and Processor Time = 7.69
Calculation of PERCENT algorithm is (Baseline + (%Threshold of Baseline)), therefore the polled value 7.69 is compared with (2.5 + (90% of 2.5)) = (2.5 +2.25)= 4.75
In Dynamic Alarms it depends on the Baseline value of QoS sample values, larger the number of data samples, more precise the baseline value. Based on that we have to configure the dynamic alarms for the particular qos and its polling value.
These Baseline values are different for every hour for that particular day, so based on these values we have to take care of configuring the Dynamic alarms.
-------------
Dynamic alarms depends on the Baseline value of QoS sample values of that day for that particular hour. Based on those values we have to configure the dynamic alarms for the particular qos.
In few cases, It might generate alarms more than the expected, as it depends on the baseline value of that particular hour of that day. for example: it might generate more alarms on Friday at 1PM - 2PM but not the same on Saturday, similarly it might change for the next week as baselines would change. Right now, you are configuring 90% threshold, you can increase it to more than 110% based on the requirement of alarms [Again, This depends on the QoS values polled for that hour and baseline for that hour).
If you want to reduce the number of alarms that are generated, you can use ToT event rule (Time Over Threshold). You can use this to filter out data spikes and monitor problematic metrics over a set period. Instead of sending an alarm immediately after a threshold violation occurs.
You can refer the below doc:
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/ca-unified-infrastructure-management-probes/GA/how-to-articles/the-time-over-threshold-event-rule.html
Feedback
