none
baseline monitoring with scom

    Question

  • Hi all

    I would like to try and baseline servers on several perfromance counters.  When I have a perfromance view selected, I then go to the actions drop down on the top of the page.  I have never been able to select any baseline options.  Does anyone know how to get them to work, or is there a good doco somewhere that explains how to use SCOM to base line a server now and then do the same test in 6 months ?

    Thanks a mill

    Paul

     


    paulk
    Wednesday, June 17, 2009 12:24 PM
    Moderator

Answers

  • Hey Paul - you could also refer to these two blogs: http://blogs.msdn.com/giraysimsek/archive/2008/04/19/self-tuning-threshold-monitors.aspx
    http://blogs.technet.com/kevinholman/archive/2008/03/19/self-tuning-thresholds-love-and-hate.aspx

    Below is an article I wrote that is published in the OpsMgr 2007 R2 help file.

    A self-tuning threshold monitor is a monitor type in Operations Manager 2007. Instead of using a fixed threshold, self-tuning threshold (STT) monitors learn from the environment and the thresholds are updated over time. This topic explains how STT monitors work and how to work with STT monitors.

    How Self-Tuning Threshold Monitors Work

    Monitors that use self-tuning thresholds are based on Windows performance counters. An STT monitor has a business cycle setting. The business cycle, which can be configured in days or weeks, establishes the period of time of normal activity that Operations Manager will use to create a signature. The signature is a numeric data provider that learns the characteristics of the business cycle. Operations Manager uses the signature to set and adjust thresholds for alerts by evaluating performance counter results against the pattern of the business cycle.

    For example, a self-tuning threshold monitor for logons to the Exchange service learns that a spike in the number of connections is expected on Monday mornings. The threshold is adjusted to account for that pattern. As a result, an alert would not be generated for the high number of logons on Monday mornings, but if a similar number of logons occurred on a Saturday night, an alert would be generated.

    Each STT monitor has an initial learning period. The initial learning period consists of one or more business cycles, depending on the configuration of the monitor. During the initial learning period, Operations Manager establishes the signature that represents regular and expected activity; no alerts are generated during the initial learning period.

    The signature is a moving baseline average and standard deviation computed during the initial learning period. The standard deviation is determined by the sensitivity level of the STT monitor. When sensitivity is set to the highest level, the deviation from the baseline for expected activity is low. When sensitivity is set to the lowest level, the deviation from the baseline for expected activity is high.

    How to Work With Self-Tuning Threshold Monitors

    When an STT monitor generates an excessive number of alerts or more than are useful for your monitoring needs, you can adjust the self-tuning threshold by lowering the sensitivity.

    A self-tuning threshold consists of two rules and a monitor. The performance collection rule collects the performance counter data, and the signature collection rule establishes the signature. The monitor compares the value of the performance counter data to the signature. You change the sensitivity of a self-tuning threshold by adjusting the sensitivity parameters for the signature collection rule and the monitor.

    The monitor has two sensitivity parameters, inner sensitivity and outer sensitivity. The inner sensitivity parameter setting for the monitor must match the sensitivity parameter setting for the signature collection rule.

    To adjust self-tuning threshold sensitivity
    1. Locate the rule that applies to the alert.

      Note
      To identify the rule that is associated with the monitor that generated the alert, run the script that is provided after this procedure.

       

       

    2. Disable the rule.

    3. Right-click the rule, point to Overrides, point to Override the Rule, and click For all objects of type:Default selection.

    4. In Override Properties, select the Override box for the Sensitivity parameter.

    5. In Override Value, change the number to increase or decrease the sensitivity level, using one of the following values:

      • 4.01 (lowest sensitivity)
      • 3.77
      • 3.29
      • 2.81
      • 2.57 (highest sensitivity)
    6. Locate the monitor that applies to the alert. The monitor name is displayed in the Details section for the alert.

    7. Disable the monitor.

    8. Right-click the monitor, point to Overrides, point to Override the Monitor, and click For all objects of type:Default selection.

    9. In Override Properties, select the Override box for the Inner Sensitivity parameter.

    10. In Override Value, change the number to the value you set in step 5.

    11. In Override Properties, select the Override box for the Outer Sensitivity parameter.

    12. In Override Value, change the number to a value greater than the number you set for the Inner Sensitivity parameter.

    13. Enable the monitor.

    14. Locate the rule from step 1 and enable the rule.

    Script for Identifying a Rule Associated with a Monitor

    Use the following script in step 1 of the previous procedure to identify the rule to disable when adjusting the sensitivity for a self-tuning threshold. Copy the script below and save it as STTSignatureCollectionRule.ps1 on the computer on which the Operations console is installed. To run the script, use the following syntax with the name of the monitor that is displayed in the alert details: STTSignatureCollectionRule <Monitor Display Name>.

     Copy Code
    ##
    ## This script prints out the collection rule associated with an STT monitor.
    ##
    ## It takes the display name of the STT monitor as input.
    ##
    ## April-13-2009
    ##
    #######################################################################################################################################################
    
    param($monitorDisplayName)
    
    $managementGroup = (Get-ManagementGroupConnection).ManagementGroup
    
    # Prepare the monitor criteria
    $monitorCriteria = New-Object Microsoft.EnterpriseManagement.Configuration.MonitorCriteria([String]::Format("DisplayName = '{0}'",$monitorDisplayName))
    
    # Get monitors
    $sttMonitor = $managementGroup.GetMonitors($monitorCriteria)[0]
    
    if (!$sttMonitor)
    {
        write-host "STT Monitor could not be found!"
        exit
    }
    
    # Get and Prepare the monitor config
    $config = ($sttMonitor).Configuration
    $config = "<Config>" + $config + "</Config>"
    
    # Get the signature id
    [System.Xml.XmlDocument] $xd = new-object System.Xml.XmlDocument
    
    $xd.LoadXml($config)
    
    $nodelist = $xd.selectnodes("/Config/SignatureID")
    
    foreach ($node in $nodelist) {
       $signatureId = $node.get_innerXml()
    }
    
    if ((!$signatureId) -or ($signatureId.Length -eq 0))
    {
        write-host "Signature Id for the STT Monitor could not be found! Make sure this is a valid STT Monitor."
        exit
    }
    
    # Iterate through the rules in the system and search for the right one.
    
    $monitoringRules = $managementGroup.GetMonitoringRules()
    
    foreach ($monitoringRule in $monitoringRules) 
    {
        $condDetectionModule = $monitoringRule.ConditionDetection
    
        if ($condDetectionModule) 
        {
            $moduleConfig = $condDetectionModule.Configuration
            
            if ($moduleConfig) 
            {
                if ($moduleConfig.Contains($signatureId))
                {
                    $outputRuleDisplayName = $monitoringRule.DisplayName
    $monitoringRule
    
                    exit
                }
            }
        }
    }
    
    # The signature collection rule not be found
    write-host "The signature collection rule associated with the STT monitor could not be found"
    
    
    
    Wednesday, June 17, 2009 4:20 PM

All replies

  • Hi,
     
    I think you have to work with self tuning thresholds to see the baseline. So you have to record a baseline before you can view it.Look at http:// technet.microsoft.com/en-us/library/bb381480.aspx for more info

    --

    Anders Bengtsson
    Microsoft MVP - Ops Mgr
    www.contoso.se
    Wednesday, June 17, 2009 1:02 PM
    Moderator
  • Hey Paul - you could also refer to these two blogs: http://blogs.msdn.com/giraysimsek/archive/2008/04/19/self-tuning-threshold-monitors.aspx
    http://blogs.technet.com/kevinholman/archive/2008/03/19/self-tuning-thresholds-love-and-hate.aspx

    Below is an article I wrote that is published in the OpsMgr 2007 R2 help file.

    A self-tuning threshold monitor is a monitor type in Operations Manager 2007. Instead of using a fixed threshold, self-tuning threshold (STT) monitors learn from the environment and the thresholds are updated over time. This topic explains how STT monitors work and how to work with STT monitors.

    How Self-Tuning Threshold Monitors Work

    Monitors that use self-tuning thresholds are based on Windows performance counters. An STT monitor has a business cycle setting. The business cycle, which can be configured in days or weeks, establishes the period of time of normal activity that Operations Manager will use to create a signature. The signature is a numeric data provider that learns the characteristics of the business cycle. Operations Manager uses the signature to set and adjust thresholds for alerts by evaluating performance counter results against the pattern of the business cycle.

    For example, a self-tuning threshold monitor for logons to the Exchange service learns that a spike in the number of connections is expected on Monday mornings. The threshold is adjusted to account for that pattern. As a result, an alert would not be generated for the high number of logons on Monday mornings, but if a similar number of logons occurred on a Saturday night, an alert would be generated.

    Each STT monitor has an initial learning period. The initial learning period consists of one or more business cycles, depending on the configuration of the monitor. During the initial learning period, Operations Manager establishes the signature that represents regular and expected activity; no alerts are generated during the initial learning period.

    The signature is a moving baseline average and standard deviation computed during the initial learning period. The standard deviation is determined by the sensitivity level of the STT monitor. When sensitivity is set to the highest level, the deviation from the baseline for expected activity is low. When sensitivity is set to the lowest level, the deviation from the baseline for expected activity is high.

    How to Work With Self-Tuning Threshold Monitors

    When an STT monitor generates an excessive number of alerts or more than are useful for your monitoring needs, you can adjust the self-tuning threshold by lowering the sensitivity.

    A self-tuning threshold consists of two rules and a monitor. The performance collection rule collects the performance counter data, and the signature collection rule establishes the signature. The monitor compares the value of the performance counter data to the signature. You change the sensitivity of a self-tuning threshold by adjusting the sensitivity parameters for the signature collection rule and the monitor.

    The monitor has two sensitivity parameters, inner sensitivity and outer sensitivity. The inner sensitivity parameter setting for the monitor must match the sensitivity parameter setting for the signature collection rule.

    To adjust self-tuning threshold sensitivity
    1. Locate the rule that applies to the alert.

      Note
      To identify the rule that is associated with the monitor that generated the alert, run the script that is provided after this procedure.

       

       

    2. Disable the rule.

    3. Right-click the rule, point to Overrides, point to Override the Rule, and click For all objects of type:Default selection.

    4. In Override Properties, select the Override box for the Sensitivity parameter.

    5. In Override Value, change the number to increase or decrease the sensitivity level, using one of the following values:

      • 4.01 (lowest sensitivity)
      • 3.77
      • 3.29
      • 2.81
      • 2.57 (highest sensitivity)
    6. Locate the monitor that applies to the alert. The monitor name is displayed in the Details section for the alert.

    7. Disable the monitor.

    8. Right-click the monitor, point to Overrides, point to Override the Monitor, and click For all objects of type:Default selection.

    9. In Override Properties, select the Override box for the Inner Sensitivity parameter.

    10. In Override Value, change the number to the value you set in step 5.

    11. In Override Properties, select the Override box for the Outer Sensitivity parameter.

    12. In Override Value, change the number to a value greater than the number you set for the Inner Sensitivity parameter.

    13. Enable the monitor.

    14. Locate the rule from step 1 and enable the rule.

    Script for Identifying a Rule Associated with a Monitor

    Use the following script in step 1 of the previous procedure to identify the rule to disable when adjusting the sensitivity for a self-tuning threshold. Copy the script below and save it as STTSignatureCollectionRule.ps1 on the computer on which the Operations console is installed. To run the script, use the following syntax with the name of the monitor that is displayed in the alert details: STTSignatureCollectionRule <Monitor Display Name>.

     Copy Code
    ##
    ## This script prints out the collection rule associated with an STT monitor.
    ##
    ## It takes the display name of the STT monitor as input.
    ##
    ## April-13-2009
    ##
    #######################################################################################################################################################
    
    param($monitorDisplayName)
    
    $managementGroup = (Get-ManagementGroupConnection).ManagementGroup
    
    # Prepare the monitor criteria
    $monitorCriteria = New-Object Microsoft.EnterpriseManagement.Configuration.MonitorCriteria([String]::Format("DisplayName = '{0}'",$monitorDisplayName))
    
    # Get monitors
    $sttMonitor = $managementGroup.GetMonitors($monitorCriteria)[0]
    
    if (!$sttMonitor)
    {
        write-host "STT Monitor could not be found!"
        exit
    }
    
    # Get and Prepare the monitor config
    $config = ($sttMonitor).Configuration
    $config = "<Config>" + $config + "</Config>"
    
    # Get the signature id
    [System.Xml.XmlDocument] $xd = new-object System.Xml.XmlDocument
    
    $xd.LoadXml($config)
    
    $nodelist = $xd.selectnodes("/Config/SignatureID")
    
    foreach ($node in $nodelist) {
       $signatureId = $node.get_innerXml()
    }
    
    if ((!$signatureId) -or ($signatureId.Length -eq 0))
    {
        write-host "Signature Id for the STT Monitor could not be found! Make sure this is a valid STT Monitor."
        exit
    }
    
    # Iterate through the rules in the system and search for the right one.
    
    $monitoringRules = $managementGroup.GetMonitoringRules()
    
    foreach ($monitoringRule in $monitoringRules) 
    {
        $condDetectionModule = $monitoringRule.ConditionDetection
    
        if ($condDetectionModule) 
        {
            $moduleConfig = $condDetectionModule.Configuration
            
            if ($moduleConfig) 
            {
                if ($moduleConfig.Contains($signatureId))
                {
                    $outputRuleDisplayName = $monitoringRule.DisplayName
    $monitoringRule
    
                    exit
                }
            }
        }
    }
    
    # The signature collection rule not be found
    write-host "The signature collection rule associated with the STT monitor could not be found"
    
    
    
    Wednesday, June 17, 2009 4:20 PM
  • Hi Satya

    This was posted on the old newsgroups by a MSFT person - do you know if it still holds true?

    "The inner sensitivity is a early design leftover.  We thought about  providing two envelopes (inner and outer) so that Customers could judge better if the inner is breached and the outer not create a different alert. We decided later that having two would only result in more noise, not more manageability.  So the inner stayed in the design and is something to fill in when you edit the management pack xml by hand."

    Cheers

    Graham

    Wednesday, June 17, 2009 4:40 PM
    Moderator