Monitors that use self-tuning thresholds are based on Windows performance counters. An STT monitor has a business cycle setting. The business cycle, which can be configured in days or weeks, establishes the period of time of normal activity that Operations Manager will use to create a signature. The signature is a numeric data provider that learns the characteristics of the business cycle. Operations Manager uses the signature to set and adjust thresholds for alerts by evaluating performance counter results against the pattern of the business cycle.

For example, a self-tuning threshold monitor for logons to the Exchange service learns that a spike in the number of connections is expected on Monday mornings. The threshold is adjusted to account for that pattern. As a result, an alert would not be generated for the high number of logons on Monday mornings, but if a similar number of logons occurred on a Saturday night, an alert would be generated.

Each STT monitor has an initial learning period. The initial learning period consists of one or more business cycles, depending on the configuration of the monitor. During the initial learning period, Operations Manager establishes the signature that represents regular and expected activity; no alerts are generated during the initial learning period.

The signature is a moving baseline average and standard deviation computed during the initial learning period. The standard deviation is determined by the sensitivity level of the STT monitor. When sensitivity is set to the highest level, the deviation from the baseline for expected activity is low. When sensitivity is set to the lowest level, the deviation from the baseline for expected activity is high.

When an STT monitor generates an excessive number of alerts or more than are useful for your monitoring needs, you can adjust the self-tuning threshold by lowering the sensitivity.

A self-tuning threshold consists of two rules and a monitor. The performance collection rule collects the performance counter data, and the signature collection rule establishes the signature. The monitor compares the value of the performance counter data to the signature. You change the sensitivity of a self-tuning threshold by adjusting the sensitivity parameters for the signature collection rule and the monitor.

The monitor has two sensitivity parameters, inner sensitivity and outer sensitivity. The inner sensitivity parameter setting for the monitor must match the sensitivity parameter setting for the signature collection rule.

1. Locate the rule that applies to the alert.

   Note
   To identify the rule that is associated with the monitor that generated the alert, run the script that is provided after this procedure.

2. Disable the rule.

3. Right-click the rule, point to Overrides, point to Override the Rule, and click For all objects of type:Default selection.

4. In Override Properties, select the Override box for the Sensitivity parameter.

5. In Override Value, change the number to increase or decrease the sensitivity level, using one of the following values:

   • 4.01 (lowest sensitivity)
     
     
   • 3.77
     
     
   • 3.29
     
     
   • 2.81
     
     
   • 2.57 (highest sensitivity)
     
     

6. Locate the monitor that applies to the alert. The monitor name is displayed in the Details section for the alert.

7. Disable the monitor.

8. Right-click the monitor, point to Overrides, point to Override the Monitor, and click For all objects of type:Default selection.

9. In Override Properties, select the Override box for the Inner Sensitivity parameter.

10. In Override Value, change the number to the value you set in step 5.

11. In Override Properties, select the Override box for the Outer Sensitivity parameter.

12. In Override Value, change the number to a value greater than the number you set for the Inner Sensitivity parameter.

13. Enable the monitor.

14. Locate the rule from step 1 and enable the rule.

Use the following script in step 1 of the previous procedure to identify the rule to disable when adjusting the sensitivity for a self-tuning threshold. Copy the script below and save it as STTSignatureCollectionRule.ps1 on the computer on which the Operations console is installed. To run the script, use the following syntax with the name of the monitor that is displayed in the alert details: STTSignatureCollectionRule <Monitor Display Name>.

Copy Code

## ## This script prints out the collection rule associated with an STT monitor. ## ## It takes the display name of the STT monitor as input. ## ## April-13-2009 ## ####################################################################################################################################################### param($monitorDisplayName) $managementGroup = (Get-ManagementGroupConnection).ManagementGroup # Prepare the monitor criteria $monitorCriteria = New-Object Microsoft.EnterpriseManagement.Configuration.MonitorCriteria([String]::Format("DisplayName = '{0}'",$monitorDisplayName)) # Get monitors $sttMonitor = $managementGroup.GetMonitors($monitorCriteria)[0] if (!$sttMonitor) { write-host "STT Monitor could not be found!" exit } # Get and Prepare the monitor config $config = ($sttMonitor).Configuration $config = "<Config>" + $config + "</Config>" # Get the signature id [System.Xml.XmlDocument] $xd = new-object System.Xml.XmlDocument $xd.LoadXml($config) $nodelist = $xd.selectnodes("/Config/SignatureID") foreach ($node in $nodelist) { $signatureId = $node.get_innerXml() } if ((!$signatureId) -or ($signatureId.Length -eq 0)) { write-host "Signature Id for the STT Monitor could not be found! Make sure this is a valid STT Monitor." exit } # Iterate through the rules in the system and search for the right one. $monitoringRules = $managementGroup.GetMonitoringRules() foreach ($monitoringRule in $monitoringRules) { $condDetectionModule = $monitoringRule.ConditionDetection if ($condDetectionModule) { $moduleConfig = $condDetectionModule.Configuration if ($moduleConfig) { if ($moduleConfig.Contains($signatureId)) { $outputRuleDisplayName = $monitoringRule.DisplayName $monitoringRule exit } } } } # The signature collection rule not be found write-host "The signature collection rule associated with the STT monitor could not be found"