Using Std. Deviation vs Std. Deviation over Baseline Event Rules

Products

• CA Infrastructure Management
• CA Performance Management - Usage and Administration
• DX NetOps

Issue/Introduction

What is the best approach for managing events using standard deviation-based rules for large groups of items that exhibit a variety of varying trend lines for the target metrics.

1. Event Rule Selection:

   • What is the best option to use in this scenario: Event Rules based on Standard Deviation only, or Event Rules based on Standard Deviation over Baseline?

2. Optimal Settings:

   • What is the best value to set these event rules to for effective monitoring and event generation?

Environment

DX NetOps Performance Management

Resolution

Following approach offers several advantages, particularly for managing large groups of items with varying trend lines for the target metrics. Here’s why:

1. Lower Administrative Overhead:

   • Using the Baseline option allows for larger groups to be governed by the rules, reducing the administrative effort required to manage individual items.

2. Consistent Assessment Across Similar Devices:

   • Applying the same Standard Deviation value against a given baseline ensures consistency. This is particularly useful for devices that have similar operational characteristics.

Example:

• Group A: Interfaces with higher utilization ranges, typically around 70%+.
• Group B: Interfaces with a normal range of 40-50%.

Using a single rule for one Standard Deviation over the baseline will generate events for both groups at the appropriate levels, tailored to their respective normal ranges.

Setting the Correct Value:

• Starting Point: Begin with an 'educated' guess based on the expected normal data for the target items.
• Adjustment: From this starting point, adjust the threshold and/or its window and duration to fine-tune the event generation, either raising or lowering the noise as needed.