In this article by Chiyo Odika coauthor of the book Microsoft System Center 2012 R2 Operations Manager Cookbook, a self-tuning threshold monitor is a Windows Performance Counter monitor type that was introduced in System Center Operations Manager 2007. Unlike monitors that use a fixed threshold (static monitors), self-tuning Threshold (STT) monitors learn what is acceptable for a performance counter and, over time, update the threshold for the performance counter.

(For more resources related to this topic, see here.)

In contrast to STTs, static thresholds are simple monitor types and are based on predefined values and counters that are monitored for conformity within the predefined values. For instance, a static threshold could be used to monitor for specific thresholds, such as Available Megabytes of Memory. Static thresholds are very useful for various monitoring scenarios but have some drawbacks. Primarily, there's some acceptable variation in performance of servers even when they fulfil the same role, and as such, a performance value that may be appropriate for one server may not apply to another. STTs were therefore created as an option for monitoring in such instances.

Baselines in SCOM 2012 R2 are used to collect the usual values for a performance counter, which then allows SCOM to adjust alert thresholds accordingly. STTs are very useful for collecting performance counter baselines on the basis of what it has learned over time.

Getting ready

To understand how STTs work, we will take a look at the basic components of an STT. To do so, we will create a self-tuning monitor using the wizard. The process for configuring an STT involves configuring the logic for the STT to learn. The configuration can be performed in the wizard for creating the performance counter monitor. To create a performance counter monitor in System Center Operations Manager, you will need to log on to a computer that has an Operations console, using an account that is a member of the Operations Manager Administrators user role, or Operations Manager Authors user role for your Operations Manager 2012 R2 management group.

Create a management pack for your custom monitor if you don't already have one.

How to do it...

For illustration purposes, we will create a 2-state self-tuning threshold monitor.

Creating a self-tuning threshold monitor

To create a self-tuning threshold monitor, carry out the following steps:

1. Log in to a computer with an account that is a member of the Operations Manager Administrators user role or Operations Manager Authors user role for the Operations Manager 2012 R2 management group.
2. In the Operations console, click on the Authoring button.
3. In the Authoring pane, expand Authoring, expand Management Pack Objects, click on Monitors, right-click on the Monitors, select Create a Monitor, select Unit Monitor, and then expand Windows Performance Counters.
4. Select 2-state Baselining, select a Destination Management Pack, and then click on Next.
5. Name the monitor, select Windows Server as your monitor target, and then select the Performance parent monitor from the drop-down option.
6. In the Object field, enter processor, enter % Processor Time in the Counter field, enter _Total in the Instance field, and set the Interval to 1 minute.

   

7. Click on Next to Configure business cycle, which is the unit of time you would like to monitor. The default is 1 week, which is fine in general, but for the purpose of illustration, select 1 Day(s).
8. Under Alerting, leave the default value of 1 business cycle(s) of analysis.
9. Move the Sensitivity slider to the left to select a low sensitivity value and then click on Next.

   

10. Leave the default values on the Configure Health screen and click on Next.
11. On the Configure Alerts screen, check the box to generate alerts for the monitor and click on Create.

How it works...

A self-tuning threshold consists of two rules and a monitor. The performance collection rule collects performance counter data, and the signature collection rule establishes a signature. The monitor compares the value of the performance counter data with the signature. The signature is a numeric data provider that learns the characteristics of a business cycle. SCOM then uses the signature to set and adjust the thresholds for alerts by evaluating performance counter results against the business cycle pattern.

In this article, we effectively created a 2-state baselining self-tuning threshold monitor, as you can see in the following screenshot:

You will find that this also created some rules such as performance collection and signature collection rules to collect performance and signature data, respectively. Data collection will occur at the frequency specified at the time the monitor was created, as you can see in the following screenshot:

You will also notice that the collection frequency values can be changed, along with the sensitivity values for the monitor, as you can see in the following screenshot:

There's more...

Monitors that use self-tuning thresholds are based on Windows performance counters and the business cycle setting. The business cycle establishes a time period of activity that SCOM will use to create a signature. The business cycle can be configured in either days or weeks, and the default is 1 week.

For example, the STT monitor for the % Processor Time counter that we created learns that processor activity for some database servers spikes between noon and 2 pm on Wednesdays. The threshold is adjusted to take that pattern into account. As a result, an alert would not be generated for a spike in processor activity at 12:30 pm on Wednesday. However, if similar processor activity spikes at the same time on Thursday, the monitor will generate an alert.

See also

For detailed information on activities listed in this article, refer to the Microsoft TechNet article Understanding Self-Tuning Threshold Monitors in the following link: http://TechNet.microsoft.com/en-us/library/dd789011.aspx.

Summary

We looked at the basic components of a self-tuning threshold to understand how STTs work. For that we created a self-tuning monitor using the wizard.

Resources for Article:

Further resources on this subject:

• Upgrading from Previous Versions [article]
• Deploying Applications and Software Updates on Microsoft System Center 2012 Configuration Manager [article]
• Unpacking System Center 2012 Orchestrator [article]