Configure trend alert settings
You can configure alert settings that monitor when a specific metric deviates from normal trends observed by the system. When the conditions configured by the alert settings are met, the ExtraHop system generates a trend alert, which you can view on the Alerts page.
Trend alerts are useful for monitoring metric trends such as unusually high round-trip times or storage servers experiencing abnormally low traffic, which might indicate a failed backup. For example, you can configure trend alert settings that generate alerts when a spike (75th percentile) in HTTP web server processing time lasts longer than 10 minutes, and where the metric value of the processing time is 100% higher than the trend.
Before configuring alert settings, determine which metric you want to monitor and the conditions the metric must meet for the ExtraHop system to generate a trend alert.
Next steps
- Alerts cannot be generated until you assign an alert configuration to a source.
- Assign an exclusion interval to an alert to suppress alerts during specific times.
- Add a notification to an alert configuration to receive emails or SNMP traps when an alert is generated.
Dataset and sampleset metric options for trend alerts
This section describes the additional options available for trend alert configurations that monitor dataset and sampleset metrics.
Option | Description | ||
---|---|---|---|
Merge | Merges all the datasets and applies the trending function to one superset of
data. For example, a 30-second aggregation roll up, or metric cycle, contains a single dataset for each 30-second interval. Therefore, a 30-minute interval has 60 datasets. You can generate a baseline for the trend from these datasets with one of the following methods:
|
||
Mean | Calculates the mean of each dataset. | ||
Percentile | Calculates a percentile of each dataset as specified in the Percentile Value field. | ||
Standard Deviation | Calculates the normal deviation compared to the current trend alert through the
same standard deviation parameters as the trend. The parameters can be absolute or
relative, as specified in the Normalization field.
|
Metric calculation options for trend alerts
This section describes the metric calculation options available when configuring the alert conditions for trend alerts.
Option | Description |
---|---|
mean | Specifies the mean value of the metric. Only select this option for sampleset metrics, such as server processing time (tprocess) by server. |
median | Specifies the 50th percentile value of the metric. Only select this option for sampleset metrics, such as server processing time (tprocess) or round trip time (rtt). |
25th percentile | Specifies the 25th percentile value of the metric. Only select this option for sampleset metrics, such as server processing time (tprocess) or round trip time (rtt). |
75th percentile | Specifies the 75th percentile value of the metric. Only select this option for sampleset metrics, such as server processing time (tprocess) or round trip time (rtt). |
count (total) | Specifies the count or total of the metric values as an absolute value. |
std. deviation | Calculates the normal deviation compared to the current metric. Only select this option for sampleset metrics, such as server processing time (tprocess) by server. |
ANY | Generates the alert when any of the specified conditions are present. |
ALL | Generates the alert when all of the specified conditions are present. |
NONE | Generates the alert when none of the specified conditions are present. |
Window options for trend alerts
This section describes the Window field options available on the Trend Settings tab that you configure when configuring a trend alert.
Option | Description |
---|---|
Same Hour of Week | Calculates the trend within a specified 1-hour window each week. |
Same Hour of Day | Calculates the trend within a specified 1-hour window each day. |
Minute Rolling Average | Calculates the trend based on the average of the data gathered each minute within a specified amount of time from the present time. |
Hour Rolling Average | Calculates the trend based on the average of the data gathered each hour within a specified amount of time from the present time. |
Weighting model options for trend alerts
This section describes the weighting model options are available when configuring trend alerts.
Option | Description | ||
---|---|---|---|
Mean | Specifies the manner in which to calculate the average.
For linear averages, the most recent value is weighted at 1 times the oldest value by default. For single and double exponential means, enter a number to weight the most recent value. |
||
Percentile | Specifies the percentile value to be referenced as a basis for creating the trend.
|
||
Regression | Specifies monitoring for increasing trends.
|
||
Standard Deviation | Calculates the normal deviation compared to the current trend.
|
||
Static Value | Calculates based on the specified static value. This option is useful to plot constant lines for SLAs. | ||
Time Delta | Applies the oldest trend to calculate a time range based on the lookback window. | ||
Trimean | Calculates the weighted average of the 25th, 50th, and 75th percentile values. | ||
Winsorized Mean | Replaces the most outlying values with the highest and lowest remaining values. Values above the 90th percentile become the same value as the 90th and values below the 10th percentile become the same value as 10th. |
Thank you for your feedback. Can we contact you to ask follow up questions?