Defining anomaly thresholds

Define anomaly thresholds to detect anomalies in performance measures on devices, links, and interfaces, and display these anomalies in the Performance Insights.

1. Create a poll definition, or modify an existing poll definition.
   • To apply anomaly thresholds to performance measures such as CPU and memory utilization on devices, and incoming and outgoing bandwidth utilization on interfaces, create or modify a basic threshold poll definition. Creating a basic threshold poll definition is described in https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/poll/task/poll_crtbasictholddef.html.
   • To apply anomaly thresholds to performance measures associated with ping operations against devices and interfaces, such as packet loss and ping time, create or modify a chassis or interface ping poll definition. Creating a chassis or interface ping poll definition is described in https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/poll/task/poll_creatingchassisandifpingpolldefs.html.
   When you define a new poll definition, all of the tabs in the Poll Definition Editor are editable, except for the NPI Anomaly Threshold tab, which is blank. Complete the other tabs but do not complete the NPI Anomaly Threshold. Complete this tab later in the procedure.
2. Ensure that the poll definition is specified in an active poll policy.
   1. If necessary, create a poll policy. For more information about creating poll policies, see https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/poll/task/poll_crtpoll.html.
   2. Set the poll definition to store historical data, by selecting the Poll Policy Properties tab in the Poll Policy Editor and clicking the Store? check box next to the name of the poll definition.
   3. Enable the poll policy. For more information about enabling poll policies, see https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/poll/task/poll_enablepoll.html.
3. Open the poll definition and define anomaly thresholds by following the instructions in the next step.
4. Click the NPI Anomaly Threshold tab and specify static thresholds for triggering performance measurement anomalies in the Device Dashboard, and associated Tivoli Netcool/OMNIbus events.
   1. In the Upper Limit and Lower Limit fields, specify the upper and lower threshold limits.
   2. In the Consecutive Occurrences spinner, specify the number of consecutive threshold violations that must occur before an anomaly and an event is generated.
   3. In the Type drop-down list, specify the threshold type. There are three types of threshold. In each threshold type, the current value is compared to the upper and lower threshold limits.

      Upper type threshold

      Use this type of threshold when the desired value of the performance measure is lower than the threshold limits.

      • If the current value exceeds the lower limit but is less than the upper limit for the specified number of consecutive occurrences, then a lower severity (orange) anomaly is generated on the Device Dashboard, and a Major Tivoli Netcool/OMNIbus event is generated.
      • If the current value exceeds the upper limit for the specified number of consecutive occurrences, a higher severity (red) anomaly is generated on the Device Dashboard, and a Critical Tivoli Netcool/OMNIbus event is generated.

      Lower type threshold

      Use this type of threshold when the desired value of the performance measure is higher than the threshold limits.

      • If the current value is less than the upper limit but higher than the lower limit for the specified number of consecutive occurrences, then a lower severity (orange) anomaly is generated on the Device Dashboard, and a Major Tivoli Netcool/OMNIbus event is generated.
      • If the current value is less than the lower limit, for the specified number of consecutive occurrences, then a higher severity (red) anomaly is generated on the Device Dashboard, and a Critical Tivoli Netcool/OMNIbus event is generated.

      Band type threshold

      Use this type of threshold when the desired value of the performance measure is within a band specified by the lower and upper threshold limits. If the current value falls outside of the band (either above or below the band) for the specified number of consecutive occurrences, a higher severity anomaly is generated on the Device Dashboard, and a Critical Tivoli Netcool/OMNIbus event is generated.

5. Click Save.