Flexible alerting - using Baseline Threshold triggers in NetCrunch
NetCrunch offers a variety of event trigger types that can be assigned to alert counters. They vary in approach giving you the flexibility to describe unique behaviors and ultimately generate the event or alert you require. This article describes the Baseline Threshold alert trigger and provides a description of the technique and use case.
The Baseline Threshold
Baseline Threshold is just one of 8 triggers available in NetCrunch.This trigger allows you to set a threshold on the deviation from previously observed behavior on a specified counter. From a logical perspective, this can be used to detect and alert on the deviation from expected behavior or unusually low or high consumption, temperature, latency, IO, etc.
One week of data is collected and hourly averages for each day are tabulated by NetCrunch. This provides a baseline for comparison of current to prior observed behavior. This can be used to provide simple spike or under-utilization detection.
Scenario for baseline threshold
The following case examines the % Committed Memory metric as a monitoring case, and expects that memory utilization by a Windows server should be stable.
Add a custom alert to the node:
- Open node settings
- Click on Custom under the Windows
- Click on Add Alert and select <New Event for Windows Performance Counter
- Click on drop-down menu with Threshold in it and select Baseline Threshold
- Click on Select counter and select Memory as Performance Object
- Select % Committed bytes in Use
- Check the Set by % box and select Threshold value
If this counter is new to the device, NetCrunch will begin to gather and store the metric, providing alerting once the appropriate historic values have been accumulated and the baseline determined. If the metric is already being monitored (monitoring pack) and one week of history is available, then alerting on deviation will occur after baseline calculations have been processed.
Deviation from baseline is greater than 10%. The baseline is 15.24 while actual % committed bytes in use is 17.45
