Create and Edit Thresholds

Define Threshold General Settings

The General Settings tab enables you to define the basic threshold settings.

1. Select the Enable check box to make the threshold active. Disabled thresholds appear in light text on the Threshold Browser.

2. When you edit a threshold that was created from a policy, click the Created By link to display the Policy Editor where you can edit the policy.

3. In the Name field, enter a unique name for the threshold.

4. For a new threshold, perform the following steps to assign the threshold to a device. You cannot edit these fields after you save the threshold.

   1. Click the Device Group drop-down and select the device group/device type in which the device is a member.

   2. Click the Device drop-down and select the device to trigger the threshold.

5. Click the Severity drop-down and select the severity to display on the Alerts page when the threshold triggers an alert.

6. If the threshold does not inherit a schedule from its parent policy, click the Schedule Edit link to display a pop-up that enables you define the times and/or dates for the threshold to run. See the Schedule section below.

7. Click the Email Edit link to display a pop-up that enables you to define email options. You can email the alerts the threshold generates to any valid email address. See the Email section below.

8. Click the Trap Destinations Edit link to display a pop-up that enables you to select where to send traps from the threshold.

   • Select the System Default check box to send traps to the trap destinations you designate as system defaults on the Trap Destination Associations page.

   • Select the Device Default check box to send traps to the trap destinations you define for the device on the Edit Device page.

   • Select the Threshold Specific check box above the list of trap destinations and then select the check box for each specific destination to which the threshold is to send traps.

9. Select the Append Condition Message check box to append the custom messages you define for each condition to the trigger message you define on the Trigger Conditions tab or to the clear message you define on the Clear Conditions tab.

   • You define the Trigger Message for all trigger conditions on the Trigger Conditions tab. See the Trigger Condition section below.

   • You define the Clear Message for all clear conditions on the Clear Conditions tab. See the Clear Condition section below.

   • You define a Custom Message for each individual trigger condition and for each individual clear condition when you define each individual condition. See the Create and Edit Conditions section below.

10. In the Description field, enter the description of the threshold. This appears only when you define the threshold.

Trigger Conditions

The Trigger Conditions tab enables you to define the conditions for which to trigger the threshold and to define the trigger message. The device name you select on the General Settings tab displays in the upper section on the tab.

1. In the Trigger Message field, enter the message to display for the threshold on the Alerts page. On the Alerts page the trigger message appears as Threshold triggered - <trigger message you enter here>. The custom message for each trigger condition appends to this trigger message when you select the Append Condition Message check box on the General tab and you enter a custom message for each trigger condition. See the Create and Edit Conditions section below. You can enter variables such as $deviceName to display the name of the device that triggered the condition, $groupName, and $deviceIp.

2. Click in the Conditions section to manage the trigger conditions.

   • Select Create New to add a new condition to the threshold. See the Create and Edit Conditions section below.

   • Select the check box for each condition to delete, then select Delete Selected to delete the conditions you select.

   • Select the check box for each condition to add to a rule, then select Add to Rule <n> to add the conditions you select to a specific rule.

3. Click in the Edit column to display the Edit Conditions pop-up. See the Create and Edit Conditions section below.

4. Click in the Rules section to manage the trigger condition rules.

   • Select Create New to add a new rule to the condition. Rule numbers are sequential. Each condition for a rule is treated as an AND Boolean operator. Add a new rule to create an OR Boolean operator. See the Boolean Operators section below.

   • Select the check box for each rule to delete, then select Delete Selected to delete the rules you select.

5. Click in the Conditions column to remove a condition from a rule.

   If you add a condition when no rule exists, the condition is assigned to Rule 1 using the AND Boolean operator.

Clear Conditions

The Clear Conditions tab enables you to define the conditions to clear the alert. If you do not define a clear condition, alerts triggered by the trigger condition continue to display on the Alerts page until you manually acknowledge the alert. The device name you select on the General Settings tab displays in the upper section on the tab.

1. In the Clear Message field, enter the message to display for the threshold on the Alert Archives. On the Alert Archives, the clear message appears as Threshold cleared - <clear message you enter here>. The custom message for each clear condition appends to this clear message when you select the Append Condition Message check box on the General tab and you enter a custom message for each clear condition. See the Create and Edit Conditions section below. You can enter variables such as $deviceName to display the name of the device that cleared the condition, $groupName, and $deviceIp.

2. Click in the Conditions section to manage the clear conditions.

   • Select Create New to add a new condition to the threshold. See the Create and Edit Conditions section below.

   • Select the check box for each condition to delete, then select Delete Selected to delete the conditions you select.

   • Select the check box for each condition to add to a rule, then select Add to Rule <n> to add the conditions to a specific rule.

3. Click in the Edit column to display the Edit Conditions pop-up. See the Create and Edit Conditions section below.

4. Click in the Rules section to manage the clear condition rules.

   • Select Create New to add a new rule to the condition. See the Boolean Operators section below.

   • Select the check box for each rule to delete, then select Delete Selected to delete the rules you select.

5. Click in the Conditions column to remove a condition from a rule.

Create and Edit Conditions

The Edit Condition pop-up enables you to define the condition to either trigger the threshold or to clear the threshold. Conditions determine when to trigger an alert and when to clear an alert.

• Static conditions compare the current value of an indicator with the value you define.

• Baseline conditions compare the current value of an indicator with the indicator's baseline value. There are three types of baseline conditions.

1. Click the Indicator drop-down and select the indicator on which to base the condition.

2. Click the Type drop-down and select a condition type option.

   • Select Static to compare the actual current indicator value to the threshold indicator value you define.

     1. Click the Comparison drop-down and select a comparison operator. Most comparison operators are self explanatory. Select Bad Polls to trigger or clear an alert when a poll attempt either receives nothing or receives invalid data. This creates a time stamp entry and an entry in the data column that represents an unsuccessful poll. This drives the SNMP Availability metric of how many unsuccessful poll attempts were made in a given cycle versus how many poll attempts were successful.

     2. In the Threshold text field, enter the value at which to trigger/clear the condition.

     3. Click the Threshold drop-down and select a threshold unit of measure.

        Examples:

        • Inbound traffic is greater than 50Mb/s

        • Idle CPU time is less than 10%

   • Select Baseline Delta to compare the actual current indicator value to the indicator's baseline value.

     1. In the Threshold text field, enter the value at which to trigger/clear the condition.

     2. Click the Threshold drop-down and select a threshold unit of measure. Percentage refers to absolute percentage points and is not to be interpreted as a percentage of the baseline value.

     3. Click the Comparison drop-down and select a comparison operator.

        Examples:

        • Inbound traffic is greater than 10Mb/s, relative to the baseline

        • Idle CPU time is less than 5%, relative to the baseline

   • Select Baseline Percentage to compare the ratio of the current indicator value to the indicator's baseline value.

     1. Click the Comparison drop-down and select a comparison operator.

     2. In the Threshold text field, enter the percentage value at which to trigger/clear the condition.

        Examples:

        • Inbound traffic is greater than 150% of the baseline

        • Idle CPU time is less than 60% of the baseline

   • Select Baseline Standard Deviation to compare the current indicator value to the indicator's expected regional value using standard deviations which is a measure that approximates the uncertainty of the value. Most data can be expected to be within 6 standard deviations of the baseline. A typical condition will test whether the data is above and/or below 2 or 3 standard deviations from the baseline value.

     1. Click the Standard Deviations drop-down and select the number of deviations. A smaller standard deviation means a tighter bracket on what is normal. The size of the standard deviation should represent the behavior of the data.

     2. Click the Direction drop-down and select Above, Below, or Above or Below the baseline. The most common use case is for Above or Below to have the condition test for deviations in both directions.

        Examples:

        • Inbound traffic is above/below 3 standard deviations of the baseline

        • Idle CPU time is below 2 standard deviations of the baseline

        Details:

        • If the baseline value is 100 and the standard deviation is 50, this does not model the expected actual value, since this appears to shift above and below the baseline value by a significant amount.

        • If the baseline value is 100 and the standard deviation is 10, this is a better representation of the normal value.

3. The Duration field has two scenarios, a smoothing time duration or a detection time duration.

   • If you select Greater Than, Less Than, Equal To, Greater Than Equal To, Less Than Equal To, or Not Equal To in the Comparison field, enter the number of minutes for which the condition is to be met before the condition triggers/clears.

   • If you select Bad Polls, Changed, Changed From, or Changed To in the Comparison field, enter the number of minutes in which the condition must occur at least once before the condition triggers/clears. The Duration for these Comparisons must be equal to or greater than the poll frequency of the device or an alert will not trigger.

4. Click the Aggregation drop-down and select a data aggregation method.

5. In the Custom Message field, enter a custom message that is specific to the condition. The custom message appends to the trigger message or to the clear message when you select the Append Condition Message check box on the General tab. You can enter variables to display things such as device name, IP address. etc. See the Custom Message Variables list below.

6. Click Save to save the condition.