What is the baseline in performance management?

[Jose Romero]

What is the baseline in performance management?

I need to know when a behavior of an interface goes out of its normal state and presents a behavior that is not normal, then send the alarm

[Jeffrey Pinard]

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/dx-netops/23-3/Performance-Monitoring-with-DX-Performance-Management/using/performance-metrics/baseline-calculations.html

[Jose Romero]

My question is, with the baseline, can I send an alarm that tells me if the behavior of the metric that I select is abnormal? 

[Jeffrey Pinard]

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/dx-netops/23-3/Performance-Monitoring-with-DX-Performance-Management/building/configure-threshold-profiles.html

Either via stddev over baseline and/or % of baseline

[Jose Romero]

Thank you for your answer, what I really want to understand is if the baseline helps me detect abnormal behavior of a metric

[Jeffrey Pinard]

Baseline records the average or total metric value every Monday at 8am, 9am, 10am, etc...  along with stddev based on variance of the data being baselined for each hour timestamp.  We use what we have up until 12 weeks, then baseline looks at last 12 weeks to set the baseline for the coming week that will be used for thresholding.

So depending if the baseline has little or alot variance will determine the stddev value.  You can threshold on number of stddev from baseline.   But when there is low variance, the stddev can be tiny and hard to threshold on.  So we added % of baseline as a check, which means if the poll value is say 5% above/below the baseline value, you can threshold on that alone or in addition to stddev.

So you can say we need to at least need to be 5% off the baseline and then 2-3 stddev.  It's possible some devices, 2-3 stddev is tiny so not until you are 5% off the baseline does it check stddev.  In some cases, 2-3 stddev could be greater than 5% of baseline.  So combining both allows you to hopefully use 1 rule to determine values outside normal. 

Normal is up to you,  how much above/below baseline and/or how many stddev is the metric to be off baseline before you want to know you need to look at the port for issues.  You can always adjust the rules over time as the events are created to your liking or not.  Or create multiple rules for different groups of interfaces with diff stddev/%baseline values.

There is no set values to use.  Each customer and environment cares about different things that are less/very important to them.