Application Real-Time Monitoring Service:Threshold detection

Prerequisites

Your application is monitored in Application Monitoring eBPF Edition. For more information, see Connect an application to Application Monitoring eBPF Edition and Manually connect an application to Application Monitoring eBPF Edition.

Configure threshold detection

1. Log on to the ARMS console. In the left-side navigation pane, choose Application Monitoring eBPF > Application Monitoring eBPF Edition Alert Rules.

2. On the alert rules page, click Create Alert Rule for Application Monitoring eBPF Edition.

3. On the Create Alert Rule for Application Monitoring eBPF Edition page, set Alert Rule Name and Alert Detection Type to Threshold Detection.

4. In the Alert Contact section, set the following parameters as needed:

   Parameter	Description
   Select Applications	Select the application that you want to detect. You can select multiple applications or all applications.
   Automatically apply this alert rule to newly created applications	Specifies whether to automatically apply this alert rule to applications that are later added to Application Monitoring.
   Metric Type	Select the type of the metric that you want to detect. For more information, see Alert metrics. Note The values of the Alert Condition and Filter Condition parameters vary based on the value of the Metric Type parameter.
   Filter Condition	The metrics are further filtered to shorten the monitoring scope. The method that is used to filter the metrics for which alerts are generated. Valid values: Traverse: traverses all values of the metric type that you specify. No Dimension: calculates the sum of all values of the metric type that you specify. =: The alert content shows only the specified values of the dimension. !=: filters the values of the metric type that you specify. The filtered values must be unequal to the value that you specify in the text box on the right. Contain: filters the values of the metric type that you specify. The filtered values must contain the value that you specify in the text box on the right. Do Not Contain: filters the values of the metric type that you specify. The filtered values cannot contain the value that you specify in the text box on the right. Match Regular Expression: filters the values of the metric type that you specify. The filtered values must conform to the regular expression that you specify in the text box on the right.

5. In the Alert rules section, select Alert trigger mode and set Alert Condition.

   Parameter	Description
   Alert trigger mode	Single Condition: An alert is triggered if the following conditions are met: Multiple Conditions: Select Alert Triggering Rules. Meet All the Following Rules: Alerts are triggered only if all the conditions are met. Meet One of the Following Rules: Alerts are triggered if one of the conditions is met.
   Alert Condition	Single condition: Set an alert rule expression. You can specify different thresholds for alerts of different severity levels. The severity of alerts increases from P4, P3, P2, and P1. You can enter the thresholds for the corresponding levels as needed. You do not need to set thresholds for all alert levels. Example 1: If the average number of JVM FullGCs in the last 5 minutes is greater than 1, a P4 alert is triggered. If the number of JVM FullGCs is greater than 2, a P3 alert is triggered. If the number of JVM FullGCs is greater than 5, a P2 alert is triggered. If the number of JVM FullGCs is greater than 10, a P1 alert is triggered. Example 2: The average number of JVM FullGC times in the last 5 minutes is greater than 1, and a P4 alert is triggered. Multiple conditions: Click Add Condition and configure an alert rule expression. Sample statement: Alert Triggering Rules: The following alert rules are met: Condition 1: The average error rate in the last 2 minutes is greater than or equal to 5%. Condition 2: The number of calls is greater than or equal to 200 in the last 2 minutes. In multi-condition mode, you must set the corresponding alert level. The alert severity increases from P4, P3, P2, and P1.
   Enter P4 recommended threshold	The threshold may be adjusted based on a graph of the threshold versus the metric. If the rule is effective for multiple applications, you can click the icon on the right side of the application to generate different recommended thresholds for different applications. ARMS uses intelligent algorithms to recommend recommended thresholds based on the historical water levels of metrics. For more information, see Recommended thresholds.
   Alert Quantity Pprediction	View the number of times that the metric is expected to exceed the threshold within the selected time period. Click a specific alert value to query the metric value that triggers an alert at a historical point in time. Each time you create or modify an alert rule, you recommend use the alert quantity prediction feature. This feature uses algorithms to analyze historical data and predict the number of alerts within the specified time range. This allows you to adjust the threshold.

6. Configure the Notification Policy parameter and parameters in the Advanced Alert Settings section.

   Parameter	Description
   Notification Policy	Do Not Specify Notification Policy: If alerts are triggered, no notification is sent. Notifications are sent only when the matching rules of a notification policy is triggered. Specify a notification policy: If you specify a notification policy, ARMS sends notifications by using the notification method specified in the notification policy. You can select an existing notification policy or create a notification policy. For more information, see Create and manage a notification policy.
   Advanced Alert Settings
   No data	This parameter is used to fix data anomalies, such as missing data, abnormal composite metrics, and abnormal period-over-period comparison results. If data anomalies can be fixed, the data is automatically changed to 0 or 1, or the alert is not triggered. For more information, see Terms.

7. Click Save.

Recommended thresholds

ARMS uses an intelligent algorithm to analyze the historical data and generate recommended static thresholds based on the specified application, interface, and metric. In addition, a chart is generated for preview. You can compare the threshold values and estimated values, and then adjust the threshold values.

Scenarios

• Assume that alerts related to a specific metric are frequently triggered, but the system is running as expected. This may be because the threshold is not properly set, or not suitable for certain applications or interfaces. In this case, you can use the recommended thresholds feature to adjust the thresholds or configure different thresholds for different applications or interfaces.

• Assume that you need to configure different thresholds for a metric of a large number of applications and interfaces. You can use the intelligent algorithm and quickly configure recommended thresholds for the applications and interfaces.

Implementation

After you click Enter P4 recommended threshold, ARMS automatically pulls the metric data of each application and interface in the last three days. Then, ARMS uses the N-sigma algorithm to calculate the average value and variance for each metric. Assume that your business keeps steady and metrics are normally distributed. The probability of three standard deviations is low. In this case, a recommended threshold can be generated based on the average value and fluctuation of the metric within the last three days.

Among the alert levels, P4 has the lowest severity. A recommended P4 threshold indicates that the metric is slightly abnormal. You can take into account the P4 threshold and configure thresholds for other alert levels, including P1, P2, and P3.

Alert quantity prediction

The alert quantity prediction feature uses an algorithm to analyze historical data, display the time when historical alerts occur, and then predicts the number of alerts within a specified period of time. The feature helps you configure static thresholds or improve alert sensitivity for dynamic thresholds.

Implementation

Based on metric data in the last 24 hours, ARMS calculates the number of times that each threshold of a metric is exceeded to predict the quantity of alerts in the future. In addition, ARMS provides the metric details, including the specific time when each threshold is exceeded. You can adjust thresholds based on your business requirements.