Table of Contents
About Target Alerts
Users to define alerts profiles that determine when an alert will be generated by NetBeez. By default, NetBeez includes some predefined Target Alert Profiles as shown in this screenshot.
An alert profile can be applied to a target in two ways:
By setting the alert profile as default which will cause it to be included in any new target created from then on.
By editing the target and checking it in the Alert Configuration section (see below).
An alert profile can be removed in two ways:
The user can delete the alert profile in the Anomaly Detection section of the NetBeez Settings, causing it to be removed from all targets where it was applied.
By editing the target and unchecking it in the Alert Configuration section.
Target Alert Metrics
Some metrics available to generate alerts are, for example:
PING packet loss
PING round-trip-time
DNS failed test
DNS query time
HTTP failed test
HTTP loading time
Traceroute failed test
Traceroute number of hops
Add/Edit Alert Profiles
Go to the NetBeez Settings by clicking on the top right cog.
Click the Anomaly Detection Tab in the NetBeez Settings and go to the Alert Profiles section.
To create a new Alert Profile, click the plus sign in the bottom table row. To edit an existing Alert Profile, click on the corresponding cog icon. A new window will appear, titled Create Alert Profile (or Edit Alert Profile).
Input a Name and select the Alert Type. Based on the Alert Type selected, the dialog will require specific information required for that alert type.
The available alert types for real-time tests (e.g. ping, DNS, HTTP, ...) are Up-Down, Down-Up, Performance Baseline, and Performance Watermark, and Performance Baseline and Watermark. The available alert types for scheduled tests (e.g. network speed, iperf, ...) are Scheduled Test Error, Scheduled Test Baseline, Scheduled Test Watermark.
After configuring your Alert Profile, click Save to exit the Alert Profile window.
To delete an Alert Profile, click the corresponding delete icon, represented by a red minus sign icon.
Alert Types for Real-Time Tests (ping, DNS, HTTP, Traceroute)
Up-Down
Up-Down Alerts are triggered when a user-determined number of consecutive tests fail. Up-down Alerts can be applied to ping, DNS, HTTP, or traceroute tests. To configure an Up-Down test:
Select Up-Down from the Alert Type select menu.
Input the number of consecutive failed tests to trigger the alert, and select the type of test from ping, DNS, and HTTP.
Click Save to exit the Alert Profile window.
Down-Up Alerts
Down-Up Alerts are the reciprocate of the Up-Down Alerts. They are triggered when a test returns data. To configure a Down-Up test:
Select Down-Up from the Alert Type select menu.
Input the number of consecutive succeeded tests to trigger the alert, and select the type of test from ping, DNS, and HTTP.
Performance Baseline Alerts
Performance Baseline Alerts are based on historical data and moving averages. A performance baseline alert is triggered when a short-term (e.g. 15 min or 1 hour) test average deviates from its long-term average (e.g. 1 day or 1 month). By comparing the short with the long-term average, we can detect ongoing performance degradation issues at a location without having to set a fixed threshold. To configure a Performance Baseline Alert:
Select Performance Baseline from the Alert Type select menu.
Select the metric from the ones currently supported:
Packet Loss (PING)
RTT (ping)
Failed Test (DNS)
Lookup Time (DNS)
Failed Test (HTTP)
Response Time (HTTP)
Select one of the short-term average options:
1 minute
5 minutes
15 minutes
1 hour
4 hours
Input a multiplier that can be a rational number (e.g. 2.5 or 0.1).
Select one of the long-term average options:
1 day
1 week
1 month
Performance Watermark Alerts
Performance Watermark Alerts are used to enforce Service Level Agreements (SLA). Performance watermark alerts are triggered when a short-term average crosses a user-defined threshold. To configure a Performance Watermark Alert:
Select Performance Watermark from the Alert Type select menu.
Select the metric from the ones currently supported:
Packet Loss (PING)
RTT (ping)
Failed Test (DNS)
Lookup Time (DNS)
Failed Test (HTTP)
Response Time (HTTP)
Select one of the short-term average options:
1 minute
5 minutes
15 minutes
1 hour
4 hours
Input a threshold value, which can be a rational or a percentage based on the metric selected.
Performance Baseline AND Watermark
Performance Baseline AND Watermark are triggered when both a baseline and a watermark condition are met. please refer to each alert type settings.
Percentile-based Mean
In the top left section of the Alert Profiles tab, you'll see a slider button to enable or disable the calculation of percentile-based means.
This function, if enabled, creates for each test two statistics: the mathematical average, which is available by default, and the percentile-based mean, which is enabled with this function. The percentile-based mean is used to filter out outliers that fall outside two times the standard deviation interval (from the mathematical average).
The benefit of this function is that should a single data point skew the mathematical average, the percentile-based mean won't be affected, thus reducing the number of false positives (alert noise).
To enable the usage of the percentile-based mean on your Alert Profiles, either edit existing alert Profiles or create new Alert Profiles and check the newly available percentile-based mean metric option, as seen in the screenshot below:
This option is available once you switch the percentile-based means calculation "ON" and choose one of the following alert types from the dropdown menu: PING: RTT, DNS: Lookup Time, or HTTP: Response Time.
Attach Alert Profiles to Targets
Performance Alert Profiles can be attached to one or more applicable Targets and Resources.
Select the Target where you want to apply Alert Profiles, and then click the Edit Target menu entry.
Locate the Alerts Configuration section at the bottom of the Edit Target panel. Alerts will be shown in a table.
Select the Alert Profile(s) that you would like applied to the Resource by clicking the checkbox in the column for that Resource. Only applicable Alert Templates will be clickable.
Click Save.
On Agent Alerts
When the server loses/re-establishes connectivity to an Agent, an alert is triggered. This type of alert can also be sent via email or SNMP trap.
To receive an email notification, the email recipient of the alert has to be added in the Default Emails field under the SMTP Alerts configuration panel (see below).
Configure Alert Notifications
You may choose to be notified via SMTP or SMNP when Performance Alerts are triggered. You may also configure alerts to be sent as a Syslog message. For more details about configuring Alert notifications, please see: