| Table of Contents |
|---|
...
Forewarned is forearmed the poverb goes, a quick google tells me "prior knowledge of possible dangers or problems gives one a tactical advantage". The reason we want to baseline and threshold our data is so that we can receive alerts forewarning us of issues in our environment, so that we can act to resolve smaller issues before they become bigger. Being proactive increases our Mean Time Between Failure.
...
The delta baseline configuration then allows for defining the level of the event based on the percentage of change, for the defaults, this would result in a Major, you can see the configuration in the example below, this table is how to visualize the configuration.
| Change % | Resulting Event Level |
|---|---|
| 10 | Warning |
| 20 | Minor |
| 30 | Major |
| 40 | Critical |
| 50 | Fatal |
If the change is below 10% the level will be normal, between 10% and 20% Minor, and so up to over 50% it will be considered fatal.
...
| Code Block |
|---|
'hrSystemProcesses' => {
'baseline' => 'delta',
'active' => 'true',
'metric' => 'hrSystemProcesses',
'type' => 'Host_Health',
'nodeModel' => 'net-snmp',
'indexed' => 'false',
'hours' => 4,
'threshold_period' => "-15 minutes",
'levels' => {
'Warning' => 10,
'Minor' => 20,
'Major' => 30,
'Critical' => 40,
'Fatal' => 50
}
}, |
Delta Baseline for Output Packets Discarded Configuration Example
Currently delta baselines do not support multi-day, but the hours value can be very large if required.
| Code Block |
|---|
'ifOutDiscards' => {
'baseline' => 'delta',
'active' => 'true',
'metric' => 'ifOutDiscards',
'type' => 'pkts_hc',
'use_index' => 'interface',
'nodeModel' => 'CiscoRouter',
'event' => 'Proactive Output Discards (Delta)',
'indexed' => 'true',
'hours' => 1,
'threshold_period' => "-15 minutes",
'levels' => {
'Warning' => 1,
'Minor' => 2,
'Major' => 3,
'Critical' => 4,
'Fatal' => 7
}
}, |
Running the Baseline Tool
...