Create a configuration settings rule

Configuration settings affect how metric data is processed. Configuration settings rules override the default metric processing behavior to determine the system actions when an anomaly is detected.

Avant de commencer

Role required: evt_mgmt_admin

Pourquoi et quand exécuter cette tâche

A number of configuration settings determine the behavior of Metric Intelligence MID Servers. In the base system, these configuration settings are configured with default values, data types, and range of valid values. You cannot directly modify these configuration settings or add new ones. However, you can create a metric configuration rule with new configuration settings that override the default values on the MID Servers.

Then, manually apply these rules to all Metric Intelligence MID Servers in a single synchronization operation, or rely on an hourly system job to perform the synchronization.

To take effect, Metric Intelligence MID Servers must be synchronized with the updates to the configuration settings rules.

It is valid to have multiple rules for a setting that affect the same CIs, in which case:

• Rules in which a filter is defined take precedence over a global rule in which no filter has been defined.
• If multiple rules that affect the same set of CIs have the same priority, then only the latest rule to be defined is applied.
• If multiple rules with different priorities affect the same set of CIs, then rules with the highest priority are applied.

Procédure

1. Navigate to All > Event Management > Anomaly Detection > Metric Config Rules.
2. On the Metric Configuration Rules pane, click New, and fill out the form.

   Tableau 1. Metric Configuration Rules form

   Field	Description
   Name	Rule name.
   Order	Rule priority within all other rules. Higher numbers represent higher priorities.
   Filter by	Check box for displaying the Rule field, where you can specify conditions that CIs must meet for the rule to apply. For example, in the choose field list, select Add Related Fields and then add the filter [class][is][Linux Server]. If clear, the rule applies globally to all CIs in the Metric To CI Mapping [sa_metric_map] table.

3. Right-click the form title, and click Save.
4. In the Metric overridden configurations form section click New, fill out the form, and then click Submit.

   Tableau 2. Metric overridden configurations form

   Field	Description
   Name	Configuration setting for which to override its value. Click the icon to display the list of all configuration settings. Click the icon to display the Metric Settings dialog with details such as range of possible values. See the following tables (Configuration Settings and Internal Configuration Settings) for details about configuration settings.
   Rule	Rule to which the created configuration setting applies.
   Value	New value that overrides the default value for the specified configuration setting.

   You can modify the following configuration settings in the Name field.

   Remarque :

   The filter specified in the metric configuration rule does not apply to settings with a global scope.

   Tableau 3. Configuration Settings

   Name and Description	Values	Default	Data Type	Scope
   anomaly_detection_enabled Enable/disable anomaly detection. Remarque : If anomaly_detection_action_level is set, then anomaly_detection_enabled is ignored.	N/A	true	boolean	CI/Metric
   anomaly_detection_action_level Action level of anomaly analysis and processing. For more information, see Configure the action level for anomaly detection.	choices: Metrics Only Bounds Anomaly Scores Anomaly Alerts IT Alerts	New records: Bounds Upgraded records: Anomaly Alerts	choice	CI/Metric
   buffer_anomaly_eviction_size Maximum number of anomalies at individual metric level that can be stored in internal buffer before sending them to instance for every CI/Metric pair.	60–1440	60	integer	Global
   buffer_ci_score_eviction_size Maximum number of anomalies at CI level that can be stored in internal buffer before sending them to instance (Currently not being used)	60–1440	60	integer	Global
   buffer_metric_eviction_size Maximum number of metrics that can be stored in internal buffer before sending them to instance for every CI/Metric pair.	60–1440	60	integer	Global
   connection_login_timeout_secs Maximum time in seconds to log in to the local database on MID Server.	30–60	30	integer	Global
   corrupt_data_count_threshold Minimum number of training points (15-minute averages) required to do any statistical analysis.	10–100	30	integer	Global
   deprioritize_early_batching_of_anomalous_ci Send anomalous CI information immediately or at regular interval.	N/A	false	boolean	Global
   mad_model_min_days Number of days for which data must be available to consider a Median Absolute Deviation based model.	10-120	10	integer	CI/Metric
   max_pool_connections_size Maximum number of connections for local database pool.	10–50	25	integer	Global
   observation_time_min Expected minimum metric observation interval.	1–1440	1	integer	CI/Metric
   robust_central_percentage Percentage of the residual data to compute the residual standard deviation, used for outlier detection. When set to 100 - uses the regular sample standard deviation.	50–100	90	double	Global
   sparse_gap_fraction_threshold If more than this percentage of data is missing and no other class has been identified, classify as SPARSE. Do not attempt to fit a WEEKLY model.	0–100	50	double	Global
   weekly_model_min_days Number of days for which data must be available in order to consider only a WEEKLY seasonality decomposition.	14-90	15	integer	CI/Metric
   daily_model_min_days Number of days for which data must be available in order to consider only a DAILY seasonality decomposition.	2-90	3	integer	CI/Metric
   build_snpm_model Enable/disable building an SNPM data model.	N/A	true	boolean	CI/Metric
   snpm_minimum_data_count Minimum number of data points required for building a stationary nonparametric model.	0 – 1e9	5000	integer	CI/Metric

   The following configuration settings are for internal usage.

   Tableau 4. Internal Configuration Settings

   Name and Description	Values	Default	Data Type	Scope
   anomaly_memory_time_min Anomaly score calculator parameter: Memory time for abnormal situation.	1–600	45	double	CI/Metric
   excess_z_score Anomaly score calculator parameter: Minimal anomalousness accumulated for outlier.	0–3	0.8	double	CI/Metric
   linear_accumulator_threshold Decision Tree Threshold: ACCUMULATOR analysis	0.5–5	1	double	Global
   low_freq_power_threshold Decision Tree Threshold: WEEKLY analysis	0–100	50	double	Global
   low_variability_threshold Decision Tree Threshold: TRENDY analysis	0.0000000001–0.001	0.0001	double	Global
   mid_freq_power_threshold Decision Tree Threshold: WEEKLY analysis	0–100	33	double	Global
   multinomial_count_threshold Decision Tree Threshold: MULTINOMIAL analysis	1–1000	40	integer	Global
   non_zero_diff_threshold Decision Tree Threshold: NEAR_CONSTANT analysis	0–100	5	double	Global
   normal_memory_time_min Anomaly score calculator parameter: Memory time for normal situation.	1–600	1	double	CI/Metric
   normal_probability_ewma_timescale_min Anomaly score calculator parameter: Normal assessment time-scale.	1–600	15	double	CI/Metric
   normal_probability_weight Anomaly score calculator parameter: Normal assessment adjustment factor.	0–1	1	double	CI/Metric
   sigmoid_offset Anomaly score calculator parameter: Anomalousness to score conversion.	0–5	2.1	double	CI/Metric
   sigmoid_weight Anomaly score calculator parameter: Anomalousness to score conversion.	0–5	1.2	double	CI/Metric
   tiny_variability_threshold Decision Tree Threshold: NEAR_CONSTANT analysis	0–0.001	0.0000000001	double	Global
   weekly_peak_hi_limit Decision Tree Threshold: WEEKLY analysis.	7–14	10	double	Global
   weekly_peak_lo_limit Decision Tree Threshold: Weekly analysis.	0.5–7	0.7	double	Global
   weekly_vs_daily_log_likelihood_threshold By how much log likelihood of weekly needs to be larger than daily, to be the preferred statistical model.	100–1000	200	double	CI/Metric
   daily_vs_noisy_log_likelihood_threshold By how much log likelihood of daily needs to be larger than noisy, to be the preferred statistical model.	20–1000	200	double	CI/Metric
   weekly_vs_noisy_log_likelihood_treshold By how much log likelihood of weekly needs to be larger than noisy, to be the preferred statistical model.	100–1000	200	double	CI/Metric
   trendy_vs_noisy_log_likelihood_threshold By how much log likelihood of trendy needs to be larger than noisy, to be the preferred statistical model.	10–1000	50	double	CI/Metric
   seasonal_loess_width_in_hours Applied to the seasonal component of a weekly or daily model before making a forecast of future behavior. If set to 0, each data point in the seasonal model becomes independent of the rest of the data points.	6–24	12	double	CI/Metric
   robustness Affects how outliers contribute to seasonal and trend calculations.	N/A	true	boolean	CI/Metric
   snpm_min_value_threshold Minimum value of data required for building an SNPM model.	-1e9 – 1e9	0	double	CI/Metric
   snpm_max_observation_interval_in_sec Maximum expected observation interval required for building an SNPM model.	60 – 600000	120	integer	CI/Metric
   min_std_jump_fraction Minimum ratio of locally calculated observation noise level to typical jump size that justifies recalculating a larger observation noise variance.	0.0 – 1.0	0.2	double	CI/Metric
   dynamic_threshold_error_smoothing Whether to use exponentially weighted moving average to smooth the residuals in the dynamic threshold analysis.	N/A	true	boolean	CI/Metric
   ewma_alpha The alpha value of the exponentially weighted moving average in dynamic threshold analysis.	1e-15 – 1.0	0.02739726027	double	CI/Metric
   dynamic_threshold_beginning_smoothing_length Number of smoothed data points to set to the mean of double the smoothing length.	0 – 10000	250	integer	CI/Metric
   dynamic_threshold_error_buffer_minutes Number of data points around each outlier to group together.	1 – 1000	30	integer	CI/Metric
   dynamic_threshold_search_start Start value at which the optimal control factor is looked for.	0.5 – 20.0	3.0	double	CI/Metric
   dynamic_threshold_search_interval Interval between search values of optimal control factor.	0.1 – 5.0	0.5	double	CI/Metric
   dynamic_threshold_search_count Number of values required for searching for optimal control factor.	1 – 50	19	integer	CI/Metric
   dynamic_threshold_error_sequence_limit Maximum number of error groups for a particular control factor value when searching.	1 – 20	5	integer	CI/Metric
   dynamic_threshold_minimum_data_count Minimum number of raw data points needed before attempting dynamic thresholding.	1 – 10000	5000	integer	CI/Metric
   linear_seasonal_log_likelihood_threshold Threshold used in deciding whether to prefer a fitted model with linear seasonality over a model with a periodic component.	10-5000	1000	integer	CI/Metric

• Synchronize configuration settings rules
  Metric Intelligence configuration settings rules contain user specified values that override default values that currently exist on Metric Intelligence MID Servers. To take effect, the Metric Intelligence MID Servers must be synchronized with the updated set of configuration settings rules.

Tâches associées

• Configure multiple MID Servers to work with Agent Client Collector Monitoring