Alarm based on historical trends

Started by Egert143, September 16, 2020, 12:06:13 PM

Previous topic - Next topic

Egert143

Hello

How hard would it be to make alert based on historical trends? For example if interface speed is unusualy low for given period.

Egert

Filipp Sudanov

Currently there is no out of the box functionality for that. It would be nice to have, but it depends of available development resources.
And the other question is how this should be implemented. Should we compare the actual value with average for, say an hour? Or with average value one day ago? Or with average on the same day of week or last business day?

First of all, you can try mean deviation threshold, it probably should increase if the value drops significantly. Number of samples in this case is the time during which the mean deviation is calculated. You need to experiment on this.

The other approach is to have two DCIs. First is collecting data as usual. Second is scheduled, e.g. every 10 minutes (it should not be too frequent to avoid producing load on the system), calculates average value of the first DCI for a period of time and stores it. First DCI then has script threshold that compares actual value with the average value. This script threshold can be quite advanced - compare value 24h ago, etc...

Please give an update how you implement this for you.