Thresholds Version 3.6

User Guide - Statseeker Version 3.6

Thresholds

Purpose of this Guide

How to configure, report, and alert on Thresholds with Statseeker.

Index

What Thresholds can be Configured in Statseeker?
Determining Optimal Threshold Levels
Example 1 - How to Configure an Interface Utilization Threshold
Example 2 - How to Configure a Network Device CPU Threshold
Example 3 - How to Configure a Cisco IPSLA Threshold
Reporting on Thresholds
Configuring Threshold Alerts

What Thresholds can be Configured in Statseeker?

Statseeker Administrators can configure Thresholds on the following data types:

Interface Utilization;
Interface Errors;
Interface Discards;
Server CPU;
Server Memory;
Server File System Usage;
Ping Delay;
Network Device CPU;
Network Device Memory;
Network Device Temperature;
Cisco IPSLA.

Determining Optimal Threshold Levels

It is important to know the optimal threshold levels of your network before you actually set thresholds.

To do this:

Go to the Network Infrastructure Monitor and open a report relevant to the threshold being configured (for example: Interfaces> Utilization);
Drill down on either the 'Device Name' or 'Interface' column to access a baseline;
Set the Time Filter drop down at the top of the report to ‘Last 30 Days’. This will display the data in a calendar format;
Analyze the data pattern to determine the most appropriate level to set the threshold. Note: the Y axis on the chart is auto-scaled based on
the statistics recorded for this data and should be taken into consideration.

The following example shows the analysis for setting an Interface Utilization threshold for the Primary WAN links.

Note: Analysis should be done across multiple interfaces to ensure Users have a solid understanding of interface baselines before configuring thresholds.

Example 1 - How to Configure an Interface Utilization Threshold

Go to Administration Tool> Thresholds> Threshold Config. A list of previously created thresholds will appear;
Select ‘Add’ (a third column will appear with configurable fields);
Skip the Name field, this should be configured last;
Select the threshold ‘Type’ of Tx or Rx Utilization;

Choose to initiate the threshold if it goes 'above' or 'below' a threshold percentage;
Set the utilization threshold 'Percent';
Set the 'Interval (mins)'. The Interval has two functions:

It sets how often Statseeker will check data against thresholds; and
It’s the time period used to calculate the average data value to determine if a threshold has been exceeded;
Note: It is recommended this value be set between 5 and 30 minutes, in 5 minutes increments. A 1 minute value is an invalid option.

Select a 'Time Filter' if necessary. If no time options are selected, the default is 24x7.

Add Interfaces to the threshold;

There are two options to add interfaces to the threshold:

Option A - Add individual interfaces to the threshold:

Note: This process is not recommended as it is difficult to maintain an accurate threshold configuration as the Network changes.

Select a device from the 'Exclude' list;

Select the interfaces to be included in the threshold. (Hold the CTRL+ or SHIFT+ keys for multiple selections);
Select the '>>' button to add interfaces to the Include list;

Repeat the process for additional interfaces on alternative devices.

Option B - Add Groups of interfaces to a threshold:

Note: This is the recommended method for adding entities to threshold configurations as Users only have to maintain Groups. Any changes to the contents of a Group will automatically flow through to a related threshold configuration.

Under the Exclude section select the ‘Change to group Selection’ button;

Select a Group of interfaces from the 'Exclude' list;
Select the '>>' button to add the Group to the Include list;

When the Include list is populated, name the threshold;
Note: The name of the threshold should be in plain text and very descriptive. This name is used as the name of the event that is logged in the Threshold events database when the threshold is exceeded. It is also used when configuring threshold alerts.
When the threshold has been named, select ‘save’.

Example 2 - How to Configure a Network Device CPU Threshold

Go to Administration Tool> Thresholds> Threshold Config. A list of any previously created Thresholds will appear;
Select ‘Add’ (a third column will appear with configurable fields);
Skip the Name field as this should be configured last;
Select the threshold ‘Type’ (Network Device CPU);

If required, add a Description for specific CPU’s to be included in this Threshold. If field is empty, all CPU’s on devices will be included in the threshold;
To find CPU Descriptions, go to Network Infrastructure Monitor> Network Devices> CPU Load report.
Set the CPU utilization threshold 'Percent';
Set the 'Interval (mins)';
The Interval has two functions:
1. It sets how often Statseeker will check data against thresholds; and
2. It is the time period used to calculate the average data value to determine if a threshold has been exceeded.
Note: It is recommended this value be set between 5 and 30 minutes, in 5 minutes increments. A 1 minute value is an invalid option;
Select a 'Time Filter' if necessary. If no time options are selected, then the default is 24x7.

Add Devices to the threshold;

There are two options to add devices to a threshold:

Option A - Add individual Devices to the threshold:

Note: This process is not recommended as it is difficult to maintain an accurate threshold configuration as the Network changes.

Select a device from the 'Exclude' list. (Hold the CTRL+ or SHIFT+ keys for multiple selections);
Select the '>>' button to move the device into the Include list;

Option B - Add Groups of Devices to the threshold:

Note: this is the recommended method for adding entities to threshold configurations as Users only have to maintain Groups. Any changes to the contents of a Group will automatically flow through to the threshold configuration

Select the ‘Change to group Selection’ button, under the Exclude section;

Select a Group from the 'Exclude' list. (Hold the CTRL+ or SHIFT+ keys for multiple selections);
Select the '>>' button to move Groups into the Include list;

When the Include list is populated, name the threshold;
Note: The name of the threshold should be in plain text and very descriptive. This name is used as the name of the event that is logged in the Threshold events database when the threshold is exceeded. It is also used when configuring threshold alerts.
When the threshold has been named, select ‘save’.

Example 3 - How to Configure a Cisco IPSLA Threshold

Go to Administration Tool> Thresholds> Threshold Config. A list of any previously created Thresholds will appear;
Select ‘Add’ (a third column will appear with configurable fields);
Skip the Name field, this should be configured last;
Select the threshold ‘Type’ Cisco IPSLA;

Add a 'Regex' (optional) that will match any ‘tag’, ‘type’ or ‘protocol’ for any IPSLA transaction for the threshold (for example: ‘http’ or ‘dns’). If left blank every transaction on a device will be included. To find out the tag, type, or protocol for IPSLA transactions, go to Network Infrastructure Monitor> Report List> Network Devices> Cisco IPSLA report;
Set the 'Delay (ms)';
Set the 'Interval (mins)'. The Interval has two functions:
1. It sets how often Statseeker will check data against thresholds; and;
2. It’s the time period used to calculate the average data value to determine if a threshold has been exceeded.
Note: It is recommended this value be set between 5 and 30 minutes, in 5 minutes increments. A 1 minute value is an invalid option;
Select a 'Time Filter' if necessary. If no time options are selected, then the default is 24x7;

Add Devices to the threshold;

There are two options to add devices to a threshold:

Option A - Add individual Devices to the threshold:

Note: This process is not recommended as it is difficult to maintain an accurate threshold configuration as the Network changes.

Select a device from the 'Exclude' list. (Hold the CTRL+ or SHIFT+ keys for multiple selections);
Select the '>>' button to move the device into the Include list;

Option B - Add Groups of Devices to the threshold:

Select the ‘Change to group Selection’ button, under the Exclude section;

Select Groups from the 'Exclude' list. (Hold the CTRL+ or SHIFT+ keys for multiple selections);
Select the '>>' to move Groups into the Include list;

When the Include list is populated, name the threshold;
Note: The name of the threshold should be in plain text and very descriptive. This name is used as the name of the event that is logged in the Threshold events database when the threshold is exceeded. It is also used when configuring threshold alerts.
When the threshold has been named, select ‘save’.

Reporting on Thresholds

It is important to monitor a new threshold configuration before creating an alert to ensure it's not set too low (in which case Users will be flooded with alerts) or set too high (in which case Users won’t see any events at all). It is recommended Users monitor the configuration for up to a week before creating alerts.

To review a threshold’s performance:

Go to the Network Infrastructure Monitor;
Select a 'Time Filter';
Run the Report List> Threshold> Event Summary report to view EVERY threshold. The total number of threshold events is provided in the summary line at the bottom of the report; or
To view details of thresholds by specific technology type, run the relevant Threshold report. In the following example a Report List> Thresholds> Interface Utilization report was selected. Note: threshold event reports only appear in the Report List after a specific threshold type has been configured.

Configuring Threshold Alerts

To configure Alerts:

Go to Administration Tool> Thresholds> Actions/Filters. A list of previously created Threshold Events Actions will appear;
To configure an Action select ‘Add’. A third column will appear with the heading Threshold Events Action Configuration;
Enter a Name for the Action;
Enter a Command (that executes a script to send the email);
Leave the Status ‘On’ which is the default setting;
Select the ‘Save Action’ button.

To configure a Filter to inform Statseeker what threshold events the action is to be applied to:

Select the ‘Go to Filters’ button;
Select 'Add';
Give the Filter a name;

Enter the regular expression that will match the threshold events for the alert;

The regular expression searches the threshold event database and matches any text from the events. The threshold event names are the names that were applied to the Threshold Config, as per below:

The regular expression can be very specific so that the exact threshold events are alerted on, or be very generic to match multiple thresholds.

The status of the Filter is ON by default, but can be turned OFF in the future, for example, if a User goes on leave and does not want to be alerted during this time;
Choose an Action:

Use the Group selection to apply this Filter to the contents of a group, or use the Entity selection to apply this Filter to one device. The default is to apply the Filter to 100% of the network. This is a popular option with thresholds, as Users normally configure thresholds only on critical links. Therefore applying the Filter to 100% of the network means that ANY threshold that matches the regular expression will be included in this alert.
Complete the Time Filter selection to apply this Filter for certain hours, for example Monday to Friday from 8:00 am to 6:00 pm. If no options are selected then the Filter is applied 24x7;
Select ‘Save Filter’.

In the example below an email will be sent every time one of the ‘WAN’ thresholds is exceeded between 8:00am to 6:00pm, Monday to Friday.