"Analysis Depth" Adjustments

[GenDev]

I've been trying to get control of our "Suspicious Incremental Backup Size" and "Unusual Job Duration" alarms. They are driving me nuts. I dont want to adjust the percentages too much because some days we have 20% change, some days we can have 200% change. I'm afraid if I make the upper and lower percentages too high and low, it'll render the alarm pretty much useless. So, I'm looking at the "Analysis Depth" setting.

Right now, its at the default of 3. My questions are:

1. Is the "depth" determine by the number of job runs or number of days? I'm assuming its job runs but I wasn't totally sure.

2. Assuming the depth is by job run, and we do incrementals daily, I can almost think of the depth as "how many previous days to analyze" (at least in my brain). Our backups can change from day to day wildly, but our weekly averages stay fairly similar. Would it make more sense to set the depth 7?

I know it's going to take some playing around with but I want to see if I'm at least on the right track.

[HannesK]

Hello,

1. the user guide says "number of latest performance data values". That means restore points in your case

2. with one backup per day, that would be days, yes. If you regularly have large increments, that's a challenge for that alarm, yes. Increasing to 7 makes sense to me, yes. Let us know, how it goes

Best regards,
Hannes

[wishr]

Hi GenDev,

Hannes is correct. Please refer to my existing post on this matter.

Thanks

[GenDev]

Thank you both for the information. It looks like we are on the right track with increasing the analysis depth to 7 to get a kind of weekly comparison. After backups last night, we cut down from about 15+ notifications to just 1.

[wishr]

Thank you for the update. Now, I would suggest identifying what exactly caused that single alarm trigger in order to define the next steps for fine-tuning.

[GenDev]

The VM that triggered the alarm had a major software update, so it was to be expected. I should've mentioned that.

[wishr]

Got it, thank you for the information.

In this case, I would leave the configuration as it is right now because it is expected to be getting the alarm in the scenarios when a lot of data has changed on a particular VM. If you start seeing regular false positives again, you may of course get back and review the analysis depth value one more time. For now, I would let it brew for a while.

Thanks