The New Way of Evaluating Dynamic Thresholds in Aria Operations

I blogged previously about Aria Operations Dynamic Thresholding, but wanted to provide an update based on changes implemented in Operations 8.17.1 and beyond. As discussed previously, Dynamic Thresholds (DTs) are enabled by default and are calculated each morning at 2 AM local (you can adjust this).

This calculation provided the next 24 hours of DTs to be used during each collection interval against Alerts/Symptoms using them. You can enable/disable DTs metric by metric in Policies via the DT State.

Before 8.17.1, each metric would be evaluated against its DT at collection time. As of 8.17.1 (and beyond), this is no longer the case. Now it's only done once daily, so how does it work?

Say you're calculating your DTs each morning at 2 AM CST. Not only does the DT engine calculate the next 24 hours of DTs (for the metrics that are enabled), but it evaluates the previous 24 hours and generates Events against objects/metrics that have violated DTs for more than 50% if its collections.

Alerts and Symptoms using DTs are now evaluated only once daily as well, at this same time. For example, if you have an Alert/Symptom combination for CPU Usage % above a DT, the DT engine will look at the previous 24 hours of DTs, and trigger if the DT was violated by more than 50% if its collections.

This new methodology has helped improve performance and reduce noise around Alerts/Symptoms using DTs.