What is Intelliprofile and Baseline in Foglight? (4309018)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

What is Intelliprofile and Baseline in Foglight?
Description

What is Intelliprofile and Baseline in Foglight?

How to set the Intelliprofile thresholds?

How the Intelliprofile is calculated?

General introduction to Intelliprofile
Cause
Static Thresholds

The classic 'Fixed Thresholds' approach is easy to use but have a few limitations
- How do uses know what thresholds to use?
- Are the values applicable at all times and all instance of the metric?
- How are all of the thresholds reviewed and maintained?
Dynamic Thresholds

Dynamic thresholds using baselines capture the time varying behavior of individual metrics. Baselines represent the 'normal' profile of a measurement by assuming that the metric's behavior isn't chaotic and is inherently cyclical. Metrics are best suited to use dynamic thresholds when
- The metric is collected periodically
- The metric shows a repeating pattern? monthly, weekly, daily etc.....
- There is a need to consider the overhead if there are a large number of metrics.
These are especially useful for capacity planning and trend analysis when understanding a systems expected data patterns is crucial to determining if a certain levels of resource consumption are normal or deviating abnormally.
Resolution
What is Intelliprofile?

IntelliProfile is like a "smart assistant" for managing your monitoring. It learns how your system normally behaves to set a "baseline" and can spot when things are different or unusual is happening by analyzing a metric's activity. It also includes noise reduction logic to ignore “noisy” edge values.

IntelliProfile assumes that any collected metric by Foglight is a result of the activities which are done in certain periods.
- For example a metric activity is usually a combination of the daily normal work, the batch jobs which are run throughout the nights and the monthly load during certain parts of the month.
IntelliProfile assumes that the periodic activities are done daily, weekly, monthly (or other custom defined periods) and then tries to detect the metric's periodic behaviors and use them in order to establish a baseline of the activity.

The IntelliProfile engine identifies several periodic behaviors such as daily, weekly monthly. The algorithm divides every period into time segments.
- For example, a day is divided into 24 one hour segments and at times, the actual metric activity is much higher what is expected. If increase in activity happens on a regular basis, IntelliProfile detects the activity and adjusts the baseline accordingly.
- On the other hand, if this increased activity is an exception and happens only once and for a short period of time, IntelliProfile filters it (by detecting it as "noise") by using a noise filtering algorithm so it doesn't affect all of the IntelliProfile results.
IntelliProfile determines which of the time frequencies calculated for the metric apply to the given timeframe. IntelliProfile composes the frequencies into a combined value to provide the following ranges:
- Green - normal behavior
- Yellow - slight deviation
- Orange – minor deviation
- Red - major deviation
(In a non-technology context, percentiles are used for example with SAT scores. If the mean SAT score is 1000, then a 95th percentile might be a score of 1540 (out of 1600), a 97 percentile might be 1580, 1590 might be a 99 percentile. Potential colleges would be interested in the top percentiles. These would be outside of the normal range and admissions groups would want to be notified about these outliers).

What is a Baseline?

A baseline is like a reference point or a normal behavior pattern over time for a particular metric (like CPU usage, memory usage, etc.). For example: If your computer's CPU usage is usually around 20% during regular tasks, that becomes the baseline. Deviations from this baseline could indicate potential issues.

What is the difference between a baseline alarm and a utilization alarm?

A baseline alarm in Foglight is triggered when there's a significant deviation from the established baseline. For example: Example: If the baseline for server response time is 100 milliseconds, a baseline alarm might be triggered if the response time suddenly increases to 500 milliseconds.

A utilization alarm is triggered when a resource (like CPU, memory, disk space) is being used at a level that may be a cause for concern, regardless of baseline. For example: If the CPU usage exceeds 90%, a utilization alarm might be triggered, indicating high resource consumption.

In simpler terms:
- Baseline Alarm: warns you when something deviates significantly from the expected normal behavior.
- Utilization Alarm: warns you when a resource is being heavily used, regardless of what is considered normal.
Think of baseline as your usual, and baseline alarm as a way of saying "Hey, this is not normal based on what we usually see." Utilization alarm is more like "Hey, this resource is being used a lot, you might want to check on it."

In Foglight, these alarms help you stay on top of your system's performance and catch potential issues early on.

Instance calculated Baseline

Once an Agent is configured to monitor an Instance, Intelliprofile will start aggregating the data and "learn" the Minimum and Maximum thresholds of the Instance, upon which Alerts will be raised.
Intelliprofile aggregates data every one hour, and requires 24 hours of data aggregation in order to build and present a realistic Baseline (by default). Once the baseline for a metric is ready (after ~24 hours), a sample will be considered normal if it is in the range of 0.00 to 97% of the baseline percentile.

As seen in the chart below, the light blue area is the Baseline minimum and maximum threshold, as aggregated for 24 hours.
The dark blue line represents the Instance workload for that time range.

The basic assumption is that the metric behaves according to certain time based patterns:
- Hour in a day
- Working day vs. non-working day
- Day (or portion of it) in a week
- Day (or portion of it) in a month
The best candidates to use metrics are those metrics that have one or more fairly low frequency repeating cycles with a high signal to noise ratio, such as the baseline range for the active time on a specified database instance.

The baseline ranges for an operating system hosting a database instance are displayed below in the blue line above the metric value bar.

Examples of Baseline Alarms

Intelliprofile within Foglight

Intelliprofile thresholds and values apply for all Agents/Instances and metrics and values influences the entire metrics for of the all Instances configured.

Based on the Intelliprofile statistics, thresholds can be set and Rules/Alarms can be raised accordingly using a scale of six levels, with each level having a different value.

The levels are as follows:

Intelliprofile level Percentile
1 1%
2 3%
3 5%
4 97%
5 99%
6 99.9%

The Alarms colors are bases upon the Intelliprofile levels and are as follows:
- Levels 1 - 4, Alarm Color (no real alarm in this case): Green.
- Levels 4 - 5, Alarm Color Yellow.
- Levels 5 - 6, Alarm Color Orange.
The Intelliprofile Minimum Threshold is set on scale 4, and the Maximum on scale 5.
Within its defaults, then, Intelliprofile will alert on Workload higher than 95%.
Meaning, that each metric that will cross the 95% usability will be caught as exceeding the normal expected behavior.
- If the current value is greater than 97% of the relevant historical observations, then Warning (Yellow)
- If the current value is greater than 99% of the relevant historical observations, then Critical (Orange)
By default, on 99% of the database metrics that use baseline thresholds, the 'normal' range is considered between 0.00 to the fourth Intelliprofile (97% = Baseline max). Samples that are beneath the baseline minimum are considered 'normal'.

Intelliprofile Minimum and maximum Thresholds can be changed in levels 4 and 5 by navigating to Administration | Data | Intelliprofile, even though this is NOT advisable. Please note that you must have the appropriate privileges in Foglight to make these changes.

Baseline Alarms and sensitivity

Baseline Alarms are fired once the maximum threshold defined is breached.

In some cases, the Baseline alarms will fire too often, and there will be a need to make IntelliProfile less sensitive.
- 99.9 is the maximum limit the IntelliProfile has. Changing the threshold of IntelliProfile to 99.9, will assure that Baseline alarms will remain as calm as possible.
This is however not recommended because it will affect all of the baseline rules for all database agents.
Additional Information

Is the algorithm used to estimate the baseline based on exponentially weighted moving average?
No. The IntelliProfile is an algorithm that analyses a metric activity and establishes the normal behavior for that metric. This is done by detecting the different periodic behavior which comprises the metric activity. The analyzed data is then used to calculate the expected activity of the metric (also known as the baseline) for different time periods. IntelliProfile assumes that any collected metric is a result of the activities which are done in certain periods. For example a metric activity is usually a combination of the daily normal work, the batch jobs which are run throughout the nights and the monthly load during certain parts of the month. IntelliProfile is based on the assumption that the periodic activities are daily, weekly, monthly (or constitute other custom defined periods). IntelliProfile tries to detect the metric periodic behaviors and use them in order to establish a baseline of the activity.

Is it based on the assumption of the data is Normally Distributed?
Yes. IntelliProfile detects frequencies (Hourly, daily and monthly time segments) in which a metric values distribution is normal and properly reflects the metric behavior.

What if the data is not Normally Distributed?
IntelliProfile tries to detect frequencies in which the values distribution is close to normal. If metric values pattern is chaotic or cannot be approximated by a normal distribution in any frequency, this impacts the quality of the baseline. This scenario is not likely to happen.

Please refer to KB 431080 for more Questions and Answers.