Discussion:
Detecting anomaly
Cristian Bichis
2012-10-08 14:24:48 UTC
Permalink
Cristian Bichis [http://community.zenoss.org/people/cbichis] created the discussion

"Detecting anomaly"

To view the discussion, visit: http://community.zenoss.org/message/68893#68893

--------------------------------------------------------------
Hello,

We are evaluating now couple solutions to change our existing Nagios/Cacti mix.

Of course, one of them is Zenoss...

I have one question related to Zenoss. We are encountering from time to time various issues on app side (or others factors). One sample: we seen today during normal business hours a drop (45%) on http servers traffic (under NAT) along with a strong increase of CPU load (90%). The cause was a wrong setting on app, the memcache IP's were updated wrongly into app.

The issue hasn't caused any problem and was not signaled by nagios as none of the limits were hit but the behavior changed very much we would like to be kept in touch when these changes of pattern are occuring. Of course, during night the patterns are changing (low traffic/res usages in the night, aso), this is not something to concern us. But the sudden change in traffic and CPU is something to be signaled to us. We don't have something in place for Nagios/Cacti now but we would like to have in Zenoss.

Has Zenoss any way to detect this anomalies and alert us? As well, there is any way to mass set these kind of alerts to services? Instead of creating individual alerts per service?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/68893#68893]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
jmp242
2012-10-08 14:42:39 UTC
Permalink
jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: Detecting anomaly"

To view the discussion, visit: http://community.zenoss.org/message/68894#68894

--------------------------------------------------------------
You could check into the predictive threshold zenpack perhaps. And look at event transforms, you could probably do some coding to only generate a specific event or the like if other events already exist? But in terms of batching events, there isn't anything OOTB for that. You might need some deep coding or hiring a consultant to do exactly what you want.

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/68894#68894]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
Shane Scott
2012-10-08 15:32:48 UTC
Permalink
Shane Scott [http://community.zenoss.org/people/hackman238] created the discussion

"Re: Detecting anomaly"

To view the discussion, visit: http://community.zenoss.org/message/68896#68896

--------------------------------------------------------------
Cristian Bichis:

Have you looked at the Holt-winters threshold? It will allow you to leverage the Holt-Winters differnantial / sliding average built in to RRD. The threshold allows you to tune the thresholds upper and lower bounds, adaptation rates and window size.

Best,
--Shane Scott (Hackman238)
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/68896#68896]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
Ryan Matte
2012-10-12 10:12:39 UTC
Permalink
Ryan Matte [http://community.zenoss.org/people/rmatte] created the discussion

"Re: Detecting anomaly"

To view the discussion, visit: http://community.zenoss.org/message/69091#69091

--------------------------------------------------------------
Just to be clear, the predictive threshold ZenPack makes use of holt-winters.  We really need to get Jane's py2.7 version of the pack posted, I've tested it in Zenoss 4 and it works fine.  I'll work on getting that posted on the ZenPack page today.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/69091#69091]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]
Loading...