The Intelligent Noise Reduction feature in ARMS Alert Management helps you find important events in large volumes of historical data. By setting a Noise Event Threshold (information entropy threshold), you can also filter and suppress noise events. You can enable this out-of-the-box feature with a single click. This topic describes how to enable and configure Intelligent Noise Reduction.
Background
Most monitoring tools identify metric anomalies and trigger alert events based on static or dynamic thresholds. These tools often support default rules that trigger preset events, such as a machine restart. Operations teams typically use multiple tools and configure a wide range of alerts. This environment, with its many monitoring sources and tools, often leads to a single issue triggering numerous redundant alert events across different systems. During a large-scale failure, this can escalate into an alert storm. This makes it challenging for operations personnel to quickly and effectively identify which alert events are important, often causing critical alerts to be lost in the noise.
- Multiple monitoring sources, alerting systems, and frequent false positives generate a high volume of repetitive, low-value events. This noise buries critical events, making them difficult to identify.
- Widespread failures can cause an alert storm.
- Dirty data, such as test events, is mixed into the event stream.
How intelligent noise reduction works
ARMS Alert Management consolidates alert events from different sources onto a unified platform. Its features include event processing flow and Intelligent Noise Reduction. Intelligent Noise Reduction uses Natural Language Processing (NLP) algorithms to determine the importance of an event based on the concepts of self-information and information entropy from information theory. Information entropy is the expected value of self-information and quantifies the amount of information an event contains, measured in bits or nats. This feature helps you discover important events from a large volume of historical data. By setting an information entropy threshold, you can also filter and suppress noise events. Intelligent Noise Reduction is an out-of-the-box feature that you can enable with a single click. The model adapts to changes in event types and content over time and updates automatically once a week without manual intervention.
- It uses NLP and a domain-specific lexicon to convert event content into word vectors, allowing for fine-grained measurement of each event.
- It builds a model to measure the information entropy and importance of word vectors, based on the concept of information entropy and the Term Frequency-Inverse Document Frequency (TF-IDF) model.
- It applies the sigmoid function to perform a non-linear, normalized measurement of the event's overall information entropy.
- It continuously trains and iterates the model based on historical event processing records and user feedback.
Enable intelligent noise reduction
Log on to the ARMS console.
- In the left-side navigation pane, choose .
- On the Events page, turn on the Intelligent Noise Reduction switch.
The Intelligent Noise Reduction switch is located in the upper-right corner of the page and turns green when enabled.Note After you enable Intelligent Noise Reduction, ARMS Alert Management pulls historical event data from the last month to train the model. If the number of events is too large, a partial dataset is pulled first.
Intelligent noise reduction details
| Parameter | Description |
| Analyzed events | The number of events analyzed by the Intelligent Noise Reduction feature. |
| Identified noise events | Events whose information entropy is lower than the specified Noise Event Threshold are classified as noise events. The default threshold is 0. |
| Noise event identification ratio | The percentage of analyzed events identified as noise events. |
| Event information entropy distribution chart | Shows the distribution of noise events and non-noise events. |
| Analysis results | The Analysis Results section lists analyzed events, which you can filter by parameters such as their noise status or information entropy. Click an event in the list to view its details. |
| Top 50 common words | The model maintains a word frequency table based on statistical analysis of historical events. This section displays the top 50 most frequent words. You can use this list to better understand the alert events in your account and to help you configure priority words and shielding words. |
Configure model parameters
On the Intelligent Noise Reduction Details page, you can configure the Noise Event Threshold, priority words, and shielding words.
| Parameter | Description |
| Noise Event Threshold | After Intelligent Noise Reduction is enabled, ARMS Alert Management calculates an information entropy value for each new event. The Noise Event Threshold serves as the dividing line between noise and non-noise events. The default value is 0. |
| priority word | In the keyword configuration, you can specify words that you want to prioritize, such as Critical or important. If an event's name or content contains a priority word, its priority is increased to prevent it from being classified as a noise event. |
| shielding word | In the keyword configuration, you can specify words that you consider unimportant, such as test or Test. If an event's name or content contains a shielding word, the event is automatically assigned an information entropy of 0. If the Noise Event Threshold is greater than 0, this classifies the event as a noise event. |
FAQ
- When should I enable Intelligent Noise Reduction?
Enable this feature when you have a large number of historical events and find it difficult to identify critical ones due to a high volume of redundant alerts.
Our internal tests show that the model's performance improves significantly once the number of historical events exceeds 1,000.
- Do I need to modify the model parameters (Noise Event Threshold, priority words, and shielding words)?
When you first start using Intelligent Noise Reduction, we recommend using the default parameter settings. After you become more familiar with the feature, you can configure priority words, shielding words, and the Noise Event Threshold to meet your specific needs.