Create and Edit Thresholds

Tab 'Periodic'

The Periodic tab enables you to define a regularly occurring time span to either enable or disable the threshold.

1. Select one of the following options.

   • Select Disable During This Time to disable the threshold for the days and/or times you define on the Periodic tab.

   • Select Enable During This Time to enable the threshold for the days and/or times you define on the Periodic tab.

2. Select the check box next to each day for the threshold to be enabled/disabled (dependent on the option you select in the previous step).

3. In the Start Time fields, enter the start time.

4. In the End Time fields, enter the end time.

5. Click the Time Zone drop-down and select a time zone.

6. Click Add to add the periodic schedule to the list of schedules.

7. Repeat the steps on the Periodic tab to add additional schedules to the list. Schedules are checked in the sequence in which they appear in the list and the first applicable schedule is applied to the threshold. If no schedule is applicable, the threshold is enabled by default.

8. Click Close to save the periodic settings.

Tab 'Schedule'

The Schedule tab enables you to schedule a specific time span to either enable or disable the threshold.

1. Select one of the following options.

   • Select Disable During This Time to disable the threshold for the time span you define on the Schedule tab.

   • Select Enable During This Time to enable the threshold for the time span you define on the Schedule tab.

2. Click in the Start Date field to display a calendar. Use the calendar to select the date to start the time span to enable/disable the threshold (dependent on the option you select in the previous step).

3. Enter the start time.

4. Click in the End Date field to display a calendar. Use the calendar to select the date to end the time span to enable/disable the threshold.

5. Enter the end time.

6. Click the Time Zone drop-down and select a time zone.

7. Click Add to add the schedule to the list of schedules.

8. Repeat the steps on the Schedule tab to add additional schedules to the list. Schedules are checked in the sequence in which they appear in the list and the first applicable schedule is applied to the threshold. If no schedule is applicable, the threshold is enabled by default.

9. Click Close to save the schedule settings.

Addresses

1. In the left Addresses field, enter the email address for a recipient.

2. Move the address to the right Addresses field.

3. Repeat the previous steps to add additional email addresses. Email addresses that appear in the right field receive an email when the threshold triggers an alert.

Users

1. In the left Users field, select the user to receive alert emails (use the Ctrl or Shift keys to multi-select).

2. Move the users you select to the right Users field. Users that appear in the right Users field receive an email when the threshold triggers an alert.

Roles

Click the Roles drop-down and select the check box for each user role whose members are to receive an email when the threshold triggers an alert.

Mail when the threshold is triggered

Select one of the following options.

• Select Just Once to only send one email when the threshold triggers the first occurrence of an alert. All subsequent occurrences (until the alert is cleared) are not emailed. This prevents an email from being sent every three minutes when a device is down.

• Select One Time Every, enter a number in the text field, then click the drop-down and select minutes, hours, or days to send multiple emails when the threshold triggers alerts.

Static Condition

Static conditions compare the current value of an indicator with the value you define.

Perform the following steps to define a Static condition.

1. Click the Object drop-down and select an object on which to base the condition.

2. Click the Indicator drop-down and select the indicator on which to base the condition.

3. Click the Type drop-down and select Static to compare the actual current indicator value to the policy indicator value you define.

4. Click the Comparison drop-down and select a comparison operator. Most comparison operators are self explanatory.
   Select Bad Polls to trigger or clear an alert when a poll attempt either receives nothing or receives invalid data. This creates a time stamp entry and an entry in the data column that represents an unsuccessful poll. This drives the SNMP Availability metric of how many unsuccessful poll attempts were made in a given cycle versus how many poll attempts were successful.

5. In the Threshold field, enter the value at which to trigger / clear the condition then click the Threshold drop-down and select the value unit of measure.

6. The Duration field has two scenarios, a smoothing time duration or a detection time duration.
   

   • If you select Greater Than, Less Than, Equal To, Greater Than Equal To, Less Than Equal To, or Not Equal To in the Comparison field, enter the number of minutes for which the condition is to be met before the condition triggers/clears.

   • If you select Bad Polls, Changed, Changed From, or Changed To in the Comparison field, enter the number of minutes in which the condition must occur at least once before the condition triggers / clears. The Duration for these Comparisons must be equal to or greater than the poll frequency of the device or an alert does not trigger.

7. Click the Aggregation drop-down and select a data aggregation method. When Count Over Threshold option is chosen from the drop-down, Count field becomes available. Specify the count number in the Count field. When Time Over Threshold option is chosen from the drop-down, Time field becomes available. Specify the time in minutes in the Time field.

   The configured time in Time Over Threshold should not be longer than the value set in field Duration.

8. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General Settings tab. You can enter variables to display such things as device name, IP address etc. Please see the Custom Message Variables list below.

   IMPORTANT

   Custom Message Variables apply to Metric policies only. These variables are not available for Flow policies.

9. Click Save to save the condition.

Baseline Condition

Baseline conditions compare the current value of an indicator with the indicator's baseline value. There are three types of baseline conditions.

1. Baseline Delta

   Examples

   • Inbound traffic is greater than 10Mb/s, relative to the baseline

   • Idle CPU time is less than 5% of the total, relative to the baseline

2. Baseline Percentage

   Examples

   • Inbound traffic is greater than 150% of the baseline

   • Idle CPU time is less than 60% of the baseline

3. Baseline Standard Deviation
   

   Examples

   • Inbound traffic is above/below three standard deviations of the baseline

   • Idle CPU time is below two standard deviations of the baseline

   • If the baseline value is 100 and the standard deviation is 50, this does not model the expected actual value, since this appears to shift above and below the baseline value by a significant amount.

   • If the baseline value is 100 and the standard deviation is 10, this is a better representation of the normal value.

Perform the following steps to define a Baseline condition.

1. Click the Object drop-down and select an object on which to base the condition.

2. Click the Indicator drop-down and select the indicator on which to base the condition.

3. Click the Type drop-down.

   • Select Baseline Delta to compare the actual current indicator value to the indicator's baseline value.

     1. In the Threshold field, enter the value at which to trigger / clear the condition then click the Threshold drop-down and select the value unit of measure. Percentage refers to a percentage of the maximum value of the indicator and is not to be interpreted as a percentage of the baseline value.

     2. Click the Comparison drop-down and select a comparison operator.

   • Select Baseline Percentage to compare the ratio of the current indicator value to the indicator's baseline value.

     1. Click the Comparison drop-down and select a comparison operator.

     2. In the Threshold field, enter the percentage value at which to trigger / clear the condition.

   • Select Baseline Standard Deviation to compare the current indicator value to the indicator's expected regional value using standard deviations which is a measure that approximates the uncertainty of the value. Most data can be expected to be within six standard deviations of the baseline. A typical condition will test whether the data is above and/or below two or three standard deviations from the baseline value.

     1. Click the Standard Deviations drop-down and select the number of deviations. A smaller standard deviation means a tighter bracket on what is normal. The size of the standard deviation should represent the behavior of the data.

     2. Click the Direction drop-down and select Above, Below, or Above or below the baseline. The most common use case is for Above or below to have the condition test for deviations in both directions.

4. The Duration field has two scenarios, a smoothing time duration or a detection time duration.
   

   • If you select Greater Than, Less Than, Equal To, Greater Than Equal To, Less Than Equal To, or Not Equal To in the Comparison field, enter the number of minutes for which the condition is to be met before the condition triggers/clears.

   • If you select Bad Polls, Changed, Changed From, or Changed To in the Comparison field, enter the number of minutes in which the condition must occur at least once before the condition triggers/clears. The Duration for these Comparisons must be equal to or greater than the poll frequency of the device or an alert does not trigger.

5. Click the Aggregation drop-down and select a data aggregation method.

6. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General Settings tab. You can enter variables to display such things as device name, IP address etc. Please see the Custom Message Variables list below.

   IMPORTANT

   Custom Message Variables apply to Metric policies only. These variables are not available for Flow policies.

7. Click Save to save the condition.

Slope Condition

Slope conditions use a data window of six most recent data points (minimum of four valid points) to perform the deviation from average (DFA) calculation or the relative standard deviation (RSD) calculation. The result of the calculation is compared to the threshold you define in the condition to trigger or clear the policy. Slope conditions looks for variation of a value from the values that came before to measure the relative consistency. This detects a significant change in behavior over a short time. A data window consists of at least four successful poll points and at most six successful poll point. As each new data point is received, the oldest data point is dropped and the new data point is validated. Whenever there are between four and six valid data points, the calculation is performed for the condition.

There are two types of slope conditions

• Slope Variance DFA - Algorithm = std::abs( (P-avg)/avg )

  • P = The value of the point.

  • avg = The average of the points within data window.

  • The return value is an absolute value that represents both increasing slope and decreasing slope at the same time.

• Slope Variance RSD - Algorithm = (100*stdDev)/avg

  • stdDev = The standard deviation from data window.

  • avg = The average of the data window.

Perform the following steps to define a Slope condition.

1. Click the Object drop-down and select an object on which to base the condition.

2. Click the Indicator drop-down and select the indicator on which to base the condition.

3. Click the Type drop-down.
   

   • Select Slope Variance DFA to compare the current indicator value to the indicator’s deviation from average value you define. This function calculates the degree to which the current value is different from the expected value and so the default threshold values are provided. This technique is also most effective when combined with other conditions.

   • Select Slope Variance RSD to compare the current indicator value to the indicator’s relative standard deviation value you define.

4. Click the Comparison drop-down and select a comparison operator.

5. In the Threshold field, enter the numeric value at which to trigger / clear the condition.

6. Duration is irrelevant for the Slope Variance DFA condition type and for the Slope Variance RSD condition type.

7. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General Settings tab. You can enter variables to display such things as device name, IP address etc. Please see the Custom Message Variables list below.

   IMPORTANT

   Custom Message Variables apply to Metric policies only. These variables are not available for Flow policies.

8. Click Save to save the condition.

Time since newest data point Condition

Time since newest data point condition allows the system to detect when the number of seconds since the newest data point exceeds the configured threshold. It also detects when data from any source is not being collected for the configured object or if there is a problem in the pipeline which results in the system to be unable to collect the data from it.

Perform the following steps to define the condition.

1. Click the Object drop-down and select an object on which to base the condition.

2. Click the Indicator drop-down and select the indicator on which to base the condition.

3. Click the Type drop-down and choose Time since newest data point.

4. In the Threshold field, enter the number of seconds since the most recent data point on a given object.

5. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General Settings tab. You can enter variables to display such things as device name, IP address etc. Please see the Custom Message Variables list below.

   IMPORTANT

   Custom Message Variables apply to Metric policies only. These variables are not available for Flow policies.

6. Click Save to save the condition.

Boolean AND Operator

The Action icons enable you to create new conditions, create new rules, and to manage the conditions to rules assignments.

To combine several conditions as a Boolean AND operator, add all of the applicable conditions to a single rule so that the Trigger / Clear Conditions tab displays the conditions as Rule 1 | Conditions A AND B AND C, etc.

Boolean OR Operator

To combine several conditions as a Boolean OR operator, create two or more rules and add applicable conditions to the applicable rules so that the Trigger / Clear Condition tab displays the conditions for the first rule OR the conditions for the second rule, OR conditions for the third rule, etc.