Create a configuration settings rule
Configuration settings affect how metric data is processed. Configuration settings rules override the default metric processing behavior to determine the system actions when an anomaly is detected.
Before you begin
Role required: evt_mgmt_admin
About this task
A number of configuration settings determine the behavior of Metric Intelligence MID Servers. In the base system, these configuration settings are configured with default values, data types, and range of valid values. You cannot directly modify these configuration settings or add new ones. However, you can create a metric configuration rule with new configuration settings that override the default values on the MID Servers.
Then, manually apply these rules to all Metric Intelligence MID Servers in a single synchronization operation, or rely on an hourly system job to perform the synchronization.
To take effect, Metric Intelligence MID Servers must be synchronized with the updates to the configuration settings rules.
It is valid to have multiple rules for a setting that affect the same CIs, in which case:
- Rules in which a filter is defined take precedence over a global rule in which no filter has been defined.
- If multiple rules that affect the same set of CIs have the same priority, then only the latest rule to be defined is applied.
- If multiple rules with different priorities affect the same set of CIs, then rules with the highest priority are applied.
Procedure
Navigate to All > Event Management > Anomaly Detection > Metric Config Rules.
On the Metric Configuration Rules pane, click New, and fill out the form.
| Field | Description |
|---|---|
| Name | Rule name. |
| Order | Rule priority within all other rules. Higher numbers represent higher priorities. |
| Filter by | Check box for displaying the Rule field, where you can specify conditions that CIs must meet for the rule to apply. For example, in the choose field list, select Add Related Fields and then add the filter [class][is][Linux Server]. If clear, the rule applies globally to all CIs in the Metric To CI Mapping [sa_metric_map] table. |
Right-click the form title, and click Save.
In the Metric overridden configurations form section click New, fill out the form, and then click Submit.
| Field | Description |
|---|---|
| Name | Configuration setting for which to override its value. Click the Image omitted: LookupUsingList.png Event Management icon icon to display the list of all configuration settings.</p> Click the Image omitted: info.png Event Management icon icon to display the <strong>Metric Settings</strong> dialog with details such as range of possible values.</p> See the following tables (Configuration Settings and Internal Configuration Settings) for details about configuration settings. |
| Rule | Rule to which the created configuration setting applies. |
| Value | New value that overrides the default value for the specified configuration setting. |
You can modify the following configuration settings in the **Name** field.
**Note:** The filter specified in the metric configuration rule does not apply to settings with a global scope.
| Name and Description | Values | Default | Data Type | Scope |
|---|---|---|---|---|
anomaly_detection_enabled Enable/disable anomaly detection. Note: If anomaly_detection_action_level is set, then anomaly_detection_enabled is ignored. | N/A | true | boolean | CI/Metric |
anomaly_detection_action_level Action level of anomaly analysis and processing. For more information, see Configure the action level for anomaly detection. | choices:- Metrics Only - Bounds - Anomaly Scores - Anomaly Alerts - IT Alerts | - New records: Bounds - Upgraded records: Anomaly Alerts | choice | CI/Metric |
buffer_anomaly_eviction_size Maximum number of anomalies at individual metric level that can be stored in internal buffer before sending them to instance for every CI/Metric pair. | 60–1440 | 60 | integer | Global |
buffer_ci_score_eviction_size Maximum number of anomalies at CI level that can be stored in internal buffer before sending them to instance (Currently not being used) | 60–1440 | 60 | integer | Global |
buffer_metric_eviction_size Maximum number of metrics that can be stored in internal buffer before sending them to instance for every CI/Metric pair. | 60–1440 | 60 | integer | Global |
connection_login_timeout_secs Maximum time in seconds to log in to the local database on MID Server. | 30–60 | 30 | integer | Global |
corrupt_data_count_threshold Minimum number of training points (15-minute averages) required to do any statistical analysis. | 10–100 | 30 | integer | Global |
deprioritize_early_batching_of_anomalous_ci Send anomalous CI information immediately or at regular interval. | N/A | false | boolean | Global |
| mad_model_min_days Number of days for which data must be available to consider a Median Absolute Deviation based model. | 10-120 | 10 | integer | CI/Metric |
| max_pool_connections_size Maximum number of connections for local database pool. | 10–50 | 25 | integer | Global |
observation_time_min Expected minimum metric observation interval. | 1–1440 | 1 | integer | CI/Metric |
robust_central_percentage Percentage of the residual data to compute the residual standard deviation, used for outlier detection. When set to 100 - uses the regular sample standard deviation. | 50–100 | 90 | double | Global |
| sparse_gap_fraction_threshold If more than this percentage of data is missing and no other class has been identified, classify as SPARSE. Do not attempt to fit a WEEKLY model. | 0–100 | 50 | double | Global |
| weekly_model_min_days Number of days for which data must be available in order to consider only a WEEKLY seasonality decomposition. | 14-90 | 15 | integer | CI/Metric |
| daily_model_min_days Number of days for which data must be available in order to consider only a DAILY seasonality decomposition. | 2-90 | 3 | integer | CI/Metric |
| build_snpm_model Enable/disable building an SNPM data model. | N/A | true | boolean | CI/Metric |
snpm_minimum_data_count Minimum number of data points required for building a stationary nonparametric model. | 0 – 1e9 | 5000 | integer | CI/Metric |
The following configuration settings are for internal usage.
| Name and Description | Values | Default | Data Type | Scope |
|---|---|---|---|---|
anomaly_memory_time_min Anomaly score calculator parameter: Memory time for abnormal situation. | 1–600 | 45 | double | CI/Metric |
excess_z_score Anomaly score calculator parameter: Minimal anomalousness accumulated for outlier. | 0–3 | 0.8 | double | CI/Metric |
linear_accumulator_threshold Decision Tree Threshold: ACCUMULATOR analysis | 0.5–5 | 1 | double | Global |
low_freq_power_threshold Decision Tree Threshold: WEEKLY analysis | 0–100 | 50 | double | Global |
low_variability_threshold Decision Tree Threshold: TRENDY analysis | 0.0000000001–0.001 | 0.0001 | double | Global |
mid_freq_power_threshold Decision Tree Threshold: WEEKLY analysis | 0–100 | 33 | double | Global |
multinomial_count_threshold Decision Tree Threshold: MULTINOMIAL analysis | 1–1000 | 40 | integer | Global |
non_zero_diff_threshold Decision Tree Threshold: NEAR_CONSTANT analysis | 0–100 | 5 | double | Global |
normal_memory_time_min Anomaly score calculator parameter: Memory time for normal situation. | 1–600 | 1 | double | CI/Metric |
normal_probability_ewma_timescale_min Anomaly score calculator parameter: Normal assessment time-scale. | 1–600 | 15 | double | CI/Metric |
normal_probability_weight Anomaly score calculator parameter: Normal assessment adjustment factor. | 0–1 | 1 | double | CI/Metric |
sigmoid_offset Anomaly score calculator parameter: Anomalousness to score conversion. | 0–5 | 2.1 | double | CI/Metric |
sigmoid_weight Anomaly score calculator parameter: Anomalousness to score conversion. | 0–5 | 1.2 | double | CI/Metric |
tiny_variability_threshold Decision Tree Threshold: NEAR_CONSTANT analysis | 0–0.001 | 0.0000000001 | double | Global |
weekly_peak_hi_limit Decision Tree Threshold: WEEKLY analysis. | 7–14 | 10 | double | Global |
weekly_peak_lo_limit Decision Tree Threshold: Weekly analysis. | 0.5–7 | 0.7 | double | Global |
weekly_vs_daily_log_likelihood_threshold By how much log likelihood of weekly needs to be larger than daily, to be the preferred statistical model. | 100–1000 | 200 | double | CI/Metric |
daily_vs_noisy_log_likelihood_threshold By how much log likelihood of daily needs to be larger than noisy, to be the preferred statistical model. | 20–1000 | 200 | double | CI/Metric |
weekly_vs_noisy_log_likelihood_treshold By how much log likelihood of weekly needs to be larger than noisy, to be the preferred statistical model. | 100–1000 | 200 | double | CI/Metric |
trendy_vs_noisy_log_likelihood_threshold By how much log likelihood of trendy needs to be larger than noisy, to be the preferred statistical model. | 10–1000 | 50 | double | CI/Metric |
seasonal_loess_width_in_hours Applied to the seasonal component of a weekly or daily model before making a forecast of future behavior. If set to 0, each data point in the seasonal model becomes independent of the rest of the data points. | 6–24 | 12 | double | CI/Metric |
robustness Affects how outliers contribute to seasonal and trend calculations. | N/A | true | boolean | CI/Metric |
snpm_min_value_threshold Minimum value of data required for building an SNPM model. | -1e9 – 1e9 | 0 | double | CI/Metric |
snpm_max_observation_interval_in_sec Maximum expected observation interval required for building an SNPM model. | 60 – 600000 | 120 | integer | CI/Metric |
min_std_jump_fraction Minimum ratio of locally calculated observation noise level to typical jump size that justifies recalculating a larger observation noise variance. | 0.0 – 1.0 | 0.2 | double | CI/Metric |
dynamic_threshold_error_smoothing Whether to use exponentially weighted moving average to smooth the residuals in the dynamic threshold analysis. | N/A | true | boolean | CI/Metric |
ewma_alpha The alpha value of the exponentially weighted moving average in dynamic threshold analysis. | 1e-15 – 1.0 | 0.02739726027 | double | CI/Metric |
dynamic_threshold_beginning_smoothing_length Number of smoothed data points to set to the mean of double the smoothing length. | 0 – 10000 | 250 | integer | CI/Metric |
dynamic_threshold_error_buffer_minutes Number of data points around each outlier to group together. | 1 – 1000 | 30 | integer | CI/Metric |
dynamic_threshold_search_start Start value at which the optimal control factor is looked for. | 0.5 – 20.0 | 3.0 | double | CI/Metric |
dynamic_threshold_search_interval Interval between search values of optimal control factor. | 0.1 – 5.0 | 0.5 | double | CI/Metric |
dynamic_threshold_search_count Number of values required for searching for optimal control factor. | 1 – 50 | 19 | integer | CI/Metric |
dynamic_threshold_error_sequence_limit Maximum number of error groups for a particular control factor value when searching. | 1 – 20 | 5 | integer | CI/Metric |
dynamic_threshold_minimum_data_count Minimum number of raw data points needed before attempting dynamic thresholding. | 1 – 10000 | 5000 | integer | CI/Metric |
linear_seasonal_log_likelihood_threshold Threshold used in deciding whether to prefer a fitted model with linear seasonality over a model with a periodic component. | 10-5000 | 1000 | integer | CI/Metric |
- Synchronize configuration settings rules
Metric Intelligence configuration settings rules contain user specified values that override default values that currently exist on Metric Intelligence MID Servers. To take effect, the Metric Intelligence MID Servers must be synchronized with the updated set of configuration settings rules.
Parent Topic:Deploying Agent Client Collector on endpoints
Related topics
Configure multiple MID Servers to work with Agent Client Collector Monitoring