Difference between automatic and fixed thresholds
Hello,
I would like to know how exactly automatic alerting works. There is often question how it works and after few different accident, exploring documentation and support ticket opening(for specific cases) I have feeling that something is missing in my knowledge. In anomaly detection settings on infrastructure page there are few different settings.
First example CPU saturation on host, if it's set automatically it will rise alert if default threshold(95%) is exceed? If it's true it could be fixed anyway at 95% and there is no need to name it automatically.
Second example is more important for me.
Based on custom settings there are two parameter and one of them needs to be exceeded to rise an alert.
But if it set to automatically only first parameter is taken to rise an alert and second one is ignored - is this true and if it is why?
What about other setting which has two parameter inside? Only first one is taken in automatic mode?
I will be grateful if someone dispel my doubts.
Michał
Best Answer
Hi Michal,
You are completely right, in the current infra sections our 'automatic' in most cases simply means we do decide on the threshold we would like to apply, while if you override it with your static threshold you decide on the threshold.
Side note: if you want an adaptive baseline you have to use the 'Custom events for alerting' section where you can opt-into a baseline also for infrastructure metrics.
Automatic also means that we can at any point in time decide to change the static threshold into a default baseline in the future, wherever we think it would be beneficial.
Concerning your second question, its a logic OR combination, which means whatever violates first is triggering the event. There are also some logic ANDs hidden in that section, e.g.: Memory alerting where we use the Mem free condition AND number of page faults. In a logic AND combination, both conditions have to violate to raise the event.
Best greetings,
Wolfgang
Hi Wolfgang,
thanks for you answer. I have only last doubt about raising alerts with two condition. I've got an information if high GC activity is set automatically only GC Time is taken and suspension time is ignored. To raise an alert to suspension event you need to set custom setting.
Is it true or was in the past?
Best Regards
Michał
