How Event Rule Window and Duration values work in Performance Management

Products

• CA Performance Management
• Network Observability

Issue/Introduction

To better determine how to set the Duration and Window values for missing critical Events being raised, it is critical to understand what to expect given different configurations. When setting up the rules the following needs to be considered in determining what values should be set.

• What is the poll cycle set on targeted Items? Default 5 minutes?
• How often should the data violate the defined threshold for the Duration value?
• Within what time frame, or Window, should the defined Duration take place before an Event is raised?

Environment

All supported Performance Management releases

Cause

Unable to properly determine the best settings for expected Events being raised.

Resolution

First we should define the values we are working with.

• Duration is how much time within the defined Window the Threshold needs to violate what is defined in the rules. It is important to note that the Duration is not consecutive but cumulative.
• Window is the amount of time we look at data seeking enough values to raise the Event based on Duration. It is a rolling Window.

Example Scenarios assuming items targeted are polling at the default 5 minute poll cycle.

1. Duration: 300 seconds/5 minutes; Window: 900 seconds/15 minutes. In this instance any one poll cycle set in the Duration, out of the possible three in the Window would raise the Event.
2. Duration: 600 seconds/10 minutes; Window: 900 seconds/15 minutes. In this instance any two poll cycles set in the Duration, out of the possible three in the Window would raise the Event. It could be poll cycle A+B, A+C, B+C, etc, that would raise the Event.
3. Duration: 900 seconds/15 minutes; Window: 900 seconds/15 minutes. In this instance three poll cycles set in the Duration, out of the possible three in the Window would raise the Event. It would require poll cycle A, B and C in a given rolling Window all violate the Threshold before the Event is raised.
4. Duration: 900 seconds/15 minutes; Window: 1800 seconds/30 minutes. In this instance three poll cycles set in the Duration, out of the possible six in the Window would raise the Event. These would be cumulative, not consecutive. As long as any three poll cycle values out of each 6 evaluated for the rolling Window violate the threshold an Event would be raised.

In these examples the first two are considered Consecutive, while the third would be considered cumulative due to how the Event Rule is defined.

The same applies to items polled at a 1 minute poll rate. Since we're evaluating thresholds against each data point loaded, and we load 1 minute polled data points every minute, the rules will evaluate 1 minute poll cycle data.

If we have a profile applied to a mix of items with both 1 and 5 minute poll rates, with Event Rules showing 1 minute Duration and Window values, we evaluate every 1 minute poll cycle data point for violations. Every 5 minutes the 5 minute polled item data points are evaluated along with the 1 minute item data points. In this scenario the 1 minute polled items would raise events against each poll cycle, same as the 5 minute, while both use the lower 1 minute Duration and Window values.

For a clear to be sent, we need to no longer have enough violating data points to meet the duration in the window, and enough data points that meet the clear criteria for the duration within the window.

We are always looking at the number of data points in the window. A new window is not created upon raise or clear.

Additional Information

• At this time there is no ability to have an event evaluated based on the sum, total or average of the values returned from the poll cycles defined in the Duration. That would be an Enhancement Request.
• How to configure Threshold Profiles in Performance Management documentation