Step 5: Set up a Threshold

A threshold defines limits against the network performance metrics (CPU load, bandwidth, disk space, and so on) of a managed entity to trigger an event (record) when a data source value goes above or below the specified limit:

  • High - equals or exceeds the threshold value, and re-arms when it equals or drops below the re-arm value (for example, bandwidth use exceeds the specified amount).

  • Low - equals or drops below the threshold value and re-arms when it equals or comes back up above the re-arm value (for example, available disk space falls under the specified value).

  • Absolute change - changes by the specified amount (for example, on a fiber-optic link, a change in loss of anything greater than 3 dB is a problem regardless of what the original or final value is).

  • Relative change - changes by percent (for example, available disk space changes more than 5% from the last poll).

These thresholds can be basic (tested against a single value) or expression-based (evaluated against multiple values in an expression). This Quick Start guide shows how to create both kinds of threshold.

Create a basic threshold

This procedure describes how to create a basic threshold for a single, system-wide variable: the number of logged-in users. This threshold tells Horizon to create an event when the number of logged-in users on the device exceeds two, and re-arm when it falls below two.

  1. Click the Gear symbol in the top-right of the screen.

  2. Under Performance Measurement, click Configure Thresholds.

    A screen with a list of preconfigured threshold groups appears. We will work with netsnmp.

    For information on how to create a threshold group, see Create a Threshold Group in the Deep Dive section.

  3. Click Edit beside the netsnmp group.

  4. Click Create New Threshold at the bottom of the Basic Thresholds area.

  5. Set the following information and click Save:

    Field Description Input value

    Type

    Triggers an event when the data source value equals or exceeds the threshold value, and re-arms when it equals or drops below the re-arm value.

    high

    Datasource

    Name of the data source you want to threshold against. For this tutorial, we have provided the data source for logged-in users. For information on how to determine a metric’s data source, see Determine the data source in the Deep Dive section.

    hrSystemNumUsers

    Datasource label

    Optional text label. Not required for this Quick Start guide.

    Leave blank.

    Value

    The value above which you want to trigger an event. In this case, we want to trigger an event when the number of logged-in users exceeds two.

    2

    Re-arm

    The value below which we want the system to re-arm. In this case, once the number of logged-in users falls below two.

    2

    Trigger

    The number of consecutive times the threshold value can occur before the system triggers an event. Since our default polling period is five minutes, a value of three means Horizon would create a threshold event if there are more than two users logged in for 15 minutes.

    3

    Description

    Optional text to describe your threshold.

    Two users

    Triggered UEI

    A custom unique event identifier (UEI) sent into the events system when the threshold is triggered. A custom UEI for each threshold makes it easier to create notifications. If left blank, it defaults to the standard thresholds UEIs.

    Leave blank.

    Re-armed UEI

    A custom unique event identifier (UEI) sent into the events system when the threshold is re-armed.

    Leave blank.

Test the threshold

To test the threshold you just created, follow these steps:

  1. SSH to the monitored node and log in to it using two different user accounts.

  2. In the main menu, choose Status  Events.

  3. Under Event Queries, click All Events.

    You should see an event that indicates your threshold triggered when more than one user logged in.

  4. Log one user out of the node.

    The Events list page should indicate that the system has re-armed.

Expression-based thresholds

By default, Horizon includes two expression-based thresholds. This section explains the threshold for CPU use, where Horizon will create an event when the five-minute CPU load average metric reaches or goes above 70% for two consecutive measurement intervals.

Expression-based thresholds are useful when you need to threshold on a percentage, not the actual value of the data collected.

Expression-based thresholds work only if the data sources in question are in the same directory.

To view the expression-based threshold for CPU use, follow these steps:

  1. Click the Gear symbol in the top-right of the screen.

  2. Under Performance Measurement, click Configure Thresholds.

  3. Click Edit beside the netsnmp group.

  4. In the Expression-Based Thresholds area, view the first threshold (with the description "Trigger an alert when five …​").

    The following table describes the fields:

    Field Description Value

    Type

    Triggers an event when the data source value equals or exceeds the threshold value, and re-arms when it equals or drops below the re-arm value.

    high

    Expression

    Divides the five-minute CPU load average by 100 (to obtain the effective load average1), which is then divided by the number of CPUs. This value is then multiplied by 100 to provide a percentage. + (1SNMP does not report in decimals, which is why the expression divides the loadavg5 by 100.)

    ((loadavg5 / 100) / CpuNumCpus) * 100

    Datasource type

    The type of data source from which you are collecting data.

    node

    Datasource label

    Optional text label. Not required for this Quick Start guide.

    Leave blank.

    Value

    Trigger an event when the five-minute CPU load average goes above 70%.

    70

    Re-arm

    Re-arm the system when the five-minute CPU load average drops below 50%.

    50

    Trigger

    The number of consecutive times the threshold value can occur before the system triggers an event. In this case, it triggers when the five-minute CPU load average goes above 70% for two consecutive polling periods.

    2

    Description

    Optional text to describe your threshold.

    Trigger an alert when the five-minute CPU load average metric reaches or goes above 70% for two consecutive measurement intervals.

    Triggered UEI

    A custom unique event identifier (UEI) sent into the events system when the threshold is triggered. A custom UEI for each threshold makes it easier to create notifications. If left blank, it defaults to the standard thresholds UEIs.

    Leave blank.

    Re-armed UEI

    A custom unique event identifier (UEI) that is sent into the events system when the threshold is re-armed.

    Leave blank.

Beyond Quick Start

Refer to Thresholding in the Deep Dive section for more information on thresholding, including the following: