How to Configure Self Tuning Threshold Monitors

  • 發行項

適用於: Exchange Server, Operations Manager 2007

The Exchange Server 2003 Management Pack contains a number of Self Tuning Threshold Monitors. A Self Tuning Threshold consists of two rules and a monitor:

  • The first rule collects the performance counter The second rule establishes a baseline

  • A monitor compares the current value of the counter to the baseline and alerts depending on the configuration of the monitor.

A self-tuning threshold monitor uses a learning process to determine the normal values for a specified performance counter object, and sets the threshold levels based on the learned values. During this learning period, Operations Manager automatically establishes a baseline representing the regular and expected activity of a computer. After the initial learning period, Operations Manager 2007 continually logs subsequent activity of the computer and compares it to the baseline.

Example: For the IS RPC Requests Monitor, the Exchange 2003 Management Pack looks at the MSExchangeIS/RPC Requests counter.

Self-tuning threshold monitors can be either two-state or three-state monitors.

  • Two-state monitor:   Given a baseline, there is an area above the baseline (A), an area below the baseline (B), and the area within the baseline (W). A two-state monitor can be used to define alerts between any two of the three areas, A-W, W-B, or A-B.

  • Three-state monitor:   Given a baseline, there is an area above the baseline (A), an area below the baseline (B), and the area within the baseline (W). A healthy state is always defined as being in the area within the baseline. An error state can be defined for either the area above (A) or the area below (B). A warning state is defined for the remaining area that was not defined as error.

For more information, see “Self Tuning Threshold Monitors” (https://go.microsoft.com/fwlink/?LinkId=86799).

Example: The IS RPC Requests Monitor in the Exchange Server 2003 Management Pack measures the number of client requests that are currently being processed by the Information Store. The baseline is created to determine what acceptable ranges for this performance counter are. After this baseline is established, this monitor determines if IS RPC Requests value is outside of the acceptable range.

Sensitivity settings determine when the monitor considers a value to be outside normal behavior. In the UI for the monitor, five sensitivity settings are shown that correspond to the following numeric values: 4.01 (low), 3.77, 3.29 (middle), 2.81, 2.57 (high). These numeric values become important when you want to override the monitor to adjust its behavior.

To locate the sensitivity setting, right click the “IS RPC Requests Monitor” and navigate to the Baselining tab. In the Alerting section you will see the Sensitivity bar with Low on the left, High on the right and Medium representing the middle mark.

A Business Cycle setting determines what the monitor considers a business cycle. Example: A business cycle might be a day or a week. For the IS RPC Requests Monitor the Management Pack uses a Business Cycle of one week.

Another setting controls how many business cycles should pass before the monitor starts alerting. An example is the IS RPC Requests Monitor where the Management Pack starts generating alerts after one week.

Default Settings for Self Tuning Threshold Monitors in the Exchange Server 2003 Management Pack

Out of the box, settings for the monitors include:

  • Monitors that are enabled by default

  • Monitors that are disabled by default as they have been replaced with static threshold monitors.

  • All the monitors have the Business Cycle set to one week and start alerting after one Business Cycle.

  • All the monitors are 2-state baselining monitors

  • All of the monitors have a “medium” sensitivity setting (this was introduced in the August 2008 version of the Management Pack). In the Baselining tab, under the Alerting section, is a bar that represents Sensitivity ranging from Low on the left side of the bar to High on the right. The middle of this bar represents medium sensitivity.

For additional details, see the “Appendix: Self Tuning Threshold Monitors” section of this guide.

Default Settings for Static Threshold Monitors in the Exchange Server 2003 Management Pack

Some Self-Tuning Threshold Monitors are disabled; they are replaced by Consecutive Samples over Threshold Monitors, which alert if the counter has been over the threshold for 3 consecutive samples. For example, we have disabled the STT for the SMTP Remote Retry Queue Monitor as it could be generating excessive numbers of alerts in conditions that did not indicate actual issues. Using a static counter for this minimizes the numbers of alerts through setting a specific value that this counter should not go beyond. You can customize this counter to reflect the actual requirements of the customer environment by using an override. For details, see the “Appendix: Self Tuning Threshold Monitors” section of this guide.

Adjusting the Self Tuning Threshold Monitors to your environment

You may find that the Self Tuning Threshold Monitors initially cause many alerts to be generated. To further adjust the behavior of the Self Tuning Threshold monitors, we recommend turning off alerting for the monitors for several Business Cycles and tracking the behavior of the associated counter. This will help you get an in-depth picture of the behavior of the counter in your environment, and give the monitor more time to adjust the baseline based on your environment.

If the counter displays irregular behavior (meaning large variations and frequent spikes), consider tuning the sensitivity by increasing the sensitivity settings on both the rule and the monitor (higher numbers lowers the sensitivity which means the monitor alerts less). For the monitor, the inner sensitivity setting must match the sensitivity setting on the rule. In addition, the outer sensitivity of the monitor must be larger than the inner sensitivity. You can change these settings by creating overrides. It is recommended to adjust the sensitivity upwards in increments corresponding to the settings exposed in the Operations Manager UI, for example from 3.29 to 3.77. Higher numbers means the monitor will alert less.

You can also consider disabling the Self Tuning Threshold Monitor and replacing it with a static Monitor, similar to the examples above, such as the RPC Averaged Latency counter. If the counter tends to be zero, or close to zero in your environment a majority of the time (or if you are unhappy with the results of a Self Tuning Threshold Monitor), it is recommended to replace the Self Tuning Threshold Monitor with a static one.

For more information on the Exchange Server 2003 counters where the management pack uses Self Tuning Threshold Monitors, see the “Appendix: Self Tuning Threshold Monitors” section of this guide.