AbnormalThresholdEngined

The Oracle Communications Unified Assurance Metric Abnormal Thresholding Engine application applies the Holt-Winters algorithm to given metrics to establish a range that a metric's value should remain within during normal operating conditions. The engine triggers an Abnormal Threshold crossing violation when the metric values exceed the normal behavior range. Once started, the Metric Abnormal Thresholding engine adapts to long-term patterns within the metrics. You can use this engine to monitor metrics such as bandwidth.

See the following USENIX proceedings publication for more information about using mathematical models for aberrant behavior detection:

http://usenix.org/legacy/publications/library/proceedings/lisa2000/full_papers/brutlag/brutlag_html/index.html

You can run this application as a service using the Services UI.

Abnormal Thresholding Engine Setup

Note:

As part of using the Metric Abnormal Thresholding Engine application, you must also enable the Metric Standard Thresholding Engine to process threshold violation messages into events.

  1. Create abnormal profiles or modify existing abnormal profiles.

    See Abnormal Profiles in Unified Assurance User's Guide for information about the UI for creating and modifying abnormal profiles.

  2. Create thresholds or modify existing thresholds, setting Type to Abnormal.

    See Thresholds in Unified Assurance User's Guide for information about the UI for creating and modifying thresholds.

  3. Add thresholds to metrics in one of the following ways:

    • Manually using the Metrics UI.

      See Metrics in Unified Assurance User's Guide for information about the UI for creating and modifying metrics.

    • Automatically during metric creation, using polling assignments or polling policies. See Polling Assignments and Polling Policies in Unified Assurance User's Guide for information about the UIs for polling assignments and policies.

    • Automatically during polling when using rules. See the AddThresholdToMetric in Unified Assurance Developer's Guide for information about the library to use and Rules in Unified Assurance User's Guide* for information about using rules.

  4. Enable the default Metric Abnormal Thresholding Engine service or create a custom service.

    See Services in Unified Assurance User's Guide for information about the UI for creating and enabling services.

Default Service

The following table shows the settings for the default Metric Abnormal Thresholding Engine service. Actual values are in bold, descriptions of values are in plaintext.

Field Value
Package coreProcessing-app
Name Metric Abnormal Thresholding Engine
Program bin/core/processing/AbnormalThresholdEngined
Arguments This field is blank. There is no default value.
Description Holt-Winters based dynamic thresholding engine
Failover Type Standalone (Supported: Standalone, Primary, Redundant/Backup)
Status Disabled
Privileged This option is not selected.

See Services in Unified Assurance User's Guide for general information about the settings for services.

See Using Application Primary/Backup Failover for more information about the different failover types.

Default Configuration

The following table shows the default configurations for the application. Actual values are in bold, descriptions of values are in plaintext.

Name Default Value Possible Values Notes
CheckTime 900 An integer How often (in seconds) where the application checks to see if there are new metrics to monitor and perform other actions.
LogFile logs/MetricAbnormalThresholdEngine.log Text, 255 characters The relative path to the log file.
LogLevel ERROR OFF, FATAL, ERROR, WARN, INFO, DEBUG The logging level for the application.
PollTime 300 An integer How often the thresholding engine checks for violations.
Threads 3 An integer The number of processing threads created.
DeviceGroupID This field is blank. There is no default value. The name of any available device group. (Optional) If specified, the thresholding engine will only look at metrics for devices in the specific group.
DeviceZoneID All Zones The name of any available device zone. (Optional) If specified, the thresholding engine will only look at metrics for devices in the specific zone.
PreferIPv4 Enabled Enabled or Disabled (Optional) Controls whether or not to prefer IPv4 transport for devices. This option is only considered if both IPv4 and IPv6 are available for a device. If this is missing, IPv6 will be preferred.

Administration Details

The following list shows the technical details you will need for advanced administration of the application: