Using Std. Deviation vs Std. Deviation over Baseline Event Rules

Products

• CA Infrastructure Management
• CA Performance Management - Usage and Administration
• DX NetOps

Issue/Introduction

Need to use Std. Deviation based rules for managing Events from large groups of items that show a variety of varying trend lines for the target metrics.

What is best to use in this scenario? Event Rules for Std. Deviation only, or use ones for Std. Deviation over Baseline?

What is the best value to set them to?

Environment

Release : 3.7

Component : IM Reporting / Admin / Configuration

Resolution

In this scenario it is likely better to use Std. Deviation over Baseline rules. It will allow larger groups to apply to the rules for lower administrative overhead.

Using the Baseline option in this scenario allows for the same Std. Deviation value to be assesses against a given baseline for similar devices.

For example maybe there are two groups of interfaces. One group has items with higher utilization ranges in the 70%+ range that is normal. The other groups items have a normal range of 40-50%.

Using a single rule for 1 Std. Deviation over the baseline generates Events for both item sets at the appropriate level.

The correct value to use will likely be an 'educated' guess as a starting point after examining the normal data expected for the target item. From there the threshold and/or it's Window and Duration can be adjusted to raise or lower the noise the Events are generating.