AbnormalThresholdEngined

The Oracle Communications Unified Assurance Metric Abnormal Thresholding Engine application applies the Holt-Winters algorithm to given metrics to establish a range that a metric's value should remain within during normal operating conditions. The engine triggers an Abnormal Threshold crossing violation when the metric values exceed the normal behavior range. Once started, the Metric Abnormal Thresholding engine adapts to long-term patterns within the metrics. You can use this engine to monitor metrics such as bandwidth.

See the following USENIX proceedings publication for more information about using mathematical models for aberrant behavior detection:

http://usenix.org/legacy/publications/library/proceedings/lisa2000/full_papers/brutlag/brutlag_html/index.html

You can run this application as a service using the Services UI.

Abnormal Thresholding Engine Setup

Note:

As part of using the Metric Abnormal Thresholding Engine application, you must also enable the Metric Standard Thresholding Engine to process threshold violation messages into events.

  1. Create abnormal profiles or modify existing abnormal profiles by using the Abnormal Profiles UI.

  2. Create thresholds or modify existing thresholds by using the Thresholds UI. Set Type to Abnormal for these thresholds.

  3. Add the thresholds to metrics. You can do this in the following ways:

    • Manually, by using the Metrics UI.

    • Automatically, during metric creation, using polling assignments or polling policies. See Polling Assignments and Polling Policies in Unified Assurance User's Guide.

    • Automatically, during polling, using rules. See AddThresholdToMetric in Unified Assurance Developer's Guide.

  4. Enable the default Metric Abnormal Thresholding Engine service, or create a custom service using specific configuration options.

    See Services in Unified Assurance User's Guide for information about the UI for creating and enabling services.

  5. Ensure that the Metric Standard Thresholding Engine service is enabled.

Default Service

The following table shows the settings for the default Metric Abnormal Thresholding Engine service. Actual values are in bold, descriptions of values are in plaintext.

Field Value
Package coreProcessing-app
Name Metric Abnormal Thresholding Engine
Program bin/core/processing/AbnormalThresholdEngined
Arguments This field is blank. There is no default value.
Description Holt-Winters based dynamic thresholding engine
Failover Type Standalone (Supported: Standalone, Primary, Redundant/Backup)
Status Disabled
Privileged This option is not selected.

See Services in Unified Assurance User's Guide for general information about the settings for services.

See Using Application Primary/Backup Failover for more information about the different failover types.

Default Configuration

The following table shows the default configurations for the application. Actual values are in bold, descriptions of values are in plaintext.

Name Default Value Possible Values Notes
CheckTime 900 An integer How often (in seconds) where the application checks to see if there are new metrics to monitor and perform other actions.
LogFile logs/MetricAbnormalThresholdEngine.log Text, 255 characters The relative path to the log file.
LogLevel ERROR OFF, FATAL, ERROR, WARN, INFO, DEBUG The logging level for the application.
PollTime 300 An integer How often the thresholding engine checks for violations.
Threads 3 An integer The number of processing threads created.
DeviceGroupID This field is blank. There is no default value. The name of any available device group. (Optional) If specified, the thresholding engine will only look at metrics for devices in the specific group.
DeviceZoneID All Zones The name of any available device zone. (Optional) If specified, the thresholding engine will only look at metrics for devices in the specific zone.
PreferIPv4 Enabled Enabled or Disabled (Optional) Controls whether or not to prefer IPv4 transport for devices. This option is only considered if both IPv4 and IPv6 are available for a device. If this is missing, IPv6 will be preferred.

Administration Details

The following list shows the technical details you will need for advanced administration of the application: