Q: My SNMP monitor can occasionally return too big performance values; they result in report graphs becoming all flat. How do I exclude such values?
A: Spike filters can help you to disregard certain performance values. In the below example we assume that “wrong” values are above 1000 and they are unlikely to appear more than twice in a row. Adjust the monitoring parameters to match your needs.
We will use Warning state condition to exclude out-of-range performance values. Click “State conditions” tab for the monitor in question, click “Click here to add up to 2 warning state conditions” and click “Value bounds”:
Specify that performance value should be 1000 or below, otherwise trigger Warning state condition; click “Use custom spike filter” after that:
Set to detect a problem only after 3 consequent attempts to enter Warning state; that will filter out up to 2 out-of-range values in a row:
Finally, click “Warning Spike filter” tab and disable common spike filter:
Click “Save” to apply the changes. You can also remove alerts for Warning state, on “Alerting” tab for the monitor, unless you need to get informed of getting out-of-range value.
By choosing appropriate value for “Detect a problem only after…” (spike filter threshold), you can exclude unwanted rare performance values.
Related topics
Check out our Knowledge Base where we answer questions regarding various topics. Use a Warning state condition with Value bounds and enable a custom spike filter. Set the bound to reject values above the chosen limit and require several consecutive bad polls before the condition is triggered. A Warning condition can identify values outside the expected range without immediately treating a single rare value as a Down state. Alerting for Warning can also be removed if those filtered values should not notify anyone. It controls how many consecutive attempts to enter the problem state are required. For example, requiring three consecutive attempts filters out up to two out-of-range values in a row.
Frequently Asked Questions
How can unusually large SNMP performance values be filtered out?
Why use a Warning condition for filtering out-of-range values?
What does the spike filter threshold control?