Analyzing an alert instance

By using Machine Learning techniques to predict KPIs time series, AIDA can detect anomalies in a KPI trend and help you quickly identify the root cause of problems.

Before you begin

When anomalies in a KPI trend generate an alert, from the Alert Instance Details page you can analyze the anomalous trend and compare it with the trend over different time intervals. You can also add correlated KPIs to the data analysis to find root causes faster.

You can reach the Alert Instance Details page in different ways:

From the Anomaly Widget on the Workload Dashboard.
From AIDA menu on the left-hand sidebar, by clicking on Overview and selecting an alert instance.
From AIDA menu on the left-hand sidebar, by clicking Alert Definitions, selecting an alert and then an alert instance.
From the link provided in the alert email notification (for AIDA administrators only).

When an alert is detected by AIDA, if you think it is a false alert, consider the following observations:

AIDA’s prediction model might not have enough data yet

Aida uses a machine learning model based on historical data. Maybe the model still has little data available to make accurate predictions. In this case, wait for the model to get more data.
The Machine Learning algorithm might need some tuning

KPIs prediction is based on a number of tuning parameters, such as the tolerance interval width, that must be properly customized. Try to better configure the tuning parameters and run a retrain process to recalculate the prediction interval with the new parameters.
You might want to pause the alert

If you think this alert is a false alert, or you don’t want to be bothered by this alert for the next few hours or days, you can pause the alert generation.

About this task

In the Alert Instance Details page, you can find a summary section with the following alert instance information:

Instance ID: The alert instance identifier.
Detection Time: Date and time when the alert instance was generated.
Severity: The severity of the alert instance. For details, see Basic concepts.
Resolution Status: The alert instance status: can be: Open or Resolved. Here you can change the status of the alert instance that you are analyzing. Alert instances in Open status are automatically marked as Resolved after a time period defined by the RESOLVE_ALERTS_AFTER_DAYS parameter configured for AIDA Exporter component (default value = 1 day)..
Special Days: Specifies if the alert instance was detected on a special day or not.
Related Alert: The name of the related alert.
Tag: The tag identifies the engine to which the KPI refers.
Alert Trigger: Set of conditions defining the alert.

The Anomaly Source KPI section shows graphs related to the KPI anomalous trend that you can compare with the trend over different time intervals. A comparison graph is shown, by default, to the right of the KPI graph, representing the KPI trend on the previous day. You can also add correlated KPIs to the data analysis to find the root cause of problem.

In each KPI graph, data is displayed in time buckets. The KPI data frequency and the reference time interval are indicated in the graph header. To view all data points, click on the Edit or add link and reduce the time interval. A light-blue area represents the expected range of values for the KPI in the reference time interval, statistically defined by AIDA based on historical data. The blue line represents the observed data that falls within the expected range of values. The orange line represents data that falls outside the expected range of values. You can zoom in or zoom out on the graph. On hovering over the KPI trend, data points appear. For each data point, a popover window displays the following information:

Date and time of the observation.
Current value: the KPI observed value.
Estimated: the KPI interval estimation.

The anomalies in the KPI trend are represented by red circles. Among these, the anomalies that contribute to generating an alert are represented by red dots. On hovering over an anomaly, the following information is displayed:

Date and time of the observation.
Current value: the KPI observed value.
Estimated: the KPI interval estimation.
Deviation: the minimum distance (with - or + sign) of the KPI observed value from its interval estimation.

In each KPI graph, you can run a number of actions:

Click on Edit or add to edit the graph time interval, or add time intervals to the graph for comparison purposes. For details, see the task Setting time intervals with the Datepicker below.
The menu icon in the upper right corner of the graph contains the following additional actions:
- Compare graph, to create a comparison graph with single or multiple time intervals for comparison purposes.
- Tuning, to tune a KPI prediction parameter, the anomaly detection sensitivity in the KPIs prediction tuning popover. This action allows you to increase or decrease sensibility, with higher sensibility identifying more anomalies. You can also modify all KPIs using the Global tuning button, which overrides individual KPI settings. These changes will be applied after the next retraining. Tuning is available to AIDA administrators only.
- Refresh, to refresh the graph after you run some tuning adjustments.
- Delete, to delete the graph.
For KPIs belonging to the Jobs category, an action icon is also present to open the workstation or job properties panel directly in HCL Workload Automation.

To deepen your analysis, you can add additional graphs to your anomaly source KPI graph:

Comparison graphs with the KPI trend over different time intervals
Correlated KPI graphs

Adding comparison graphs

About this task

You can add comparison graphs, both to anomaly source KPIs and correlated KPIs.

For the KPI: Jobs in plan by status

For the KPI Jobs in plan by status, a comparison graph is shown, by default, representing the KPI trend during the previous day.

For both graphs, you can edit the time interval, or add time intervals for comparison:

In the graph that you want to modify, click Edit or add to open the Datepicker panel where you can:
- edit the time interval
- add time intervals for comparison

For the remaining KPIs

You can edit the time interval, or add multiple time intervals to any KPI graph for comparison:

In the graph, click Edit or add to open the Datepicker panel where you can:
- edit the time interval
- add time intervals for comparison

To enhance the analysis, you can generate an additional graph.

From the menu icon in the upper right corner of the graph, select Compare graph. The Datepicker panel opens where you can create a comparison graph with single or multiple time intervals.

For details about Datepicker, see Setting time intervals with the Datepicker.

Note: In the graphs showing KPI trends in multiple time intervals, the gray area representing the expected KPI values in each time interval is not displayed.

Adding correlated KPIs

About this task

You can add one or more correlated KPIs to the anomaly data analysis from the Add KPI panel that you can open in either of the following ways:

In the Correlated KPI area, click Add Correlated KPI.
In the upper right corner of the Anomaly Data Analysis UI, click the Add KPI button.

On the left-hand side of the Add KPI panel, select a KPI category.

For each KPI of the selected category, the following information is displayed:

KPI Name

Name of the KPI

Object Name

The name of the object measured by the KPI.

Tag

A search tag for the KPI. Usually, the tag is used to identify the engine to which the KPI refers.

Anomaly %

The percentage of observed KPI data points that fall outside the expected range of values in the reference time interval:

< 6 : Low
6-10: Medium
>10: High

To select correlated KPIs, run the following steps:

Procedure

Use the search bar to refine your search.
Select one or more KPIs.
Click the Add KPI button.

Results

A new graph for each selected KPI is added to the Correlated KPI area, representing the KPI trend in the reference time interval.

As for the anomaly source KPIs, you can add comparison graphs to the correlated KPIs. For details, see Adding comparison graphs.

Setting time intervals with the Datepicker

Before you begin

Use the Datepicker to set single or multiple time intervals in a KPI graph.

In the Datepicker panel, select the type of interval:

Single Interval

To edit a time interval in a KPI graph
To add a KPI comparison graph with a single time interval

Multiple Intervals

To edit multiple time intervals in a KPI graph
To add a KPI comparison graph with multiple time intervals

Setting a single time interval

About this task

The Single interval section contains the following fields:

Start Date
Start Time
End Date
End Time

When you first open the Datepicker panel, these fields are set to the current time interval values in the KPI graph.

Two calendar widgets are provided to assist you in setting a new interval: the left calendar assists you in setting the start date, while the right calendar assists you in setting the end date.

To further assist you in setting a new interval, both calendars highlight:

Anomaly %

The percentage of observed KPI data points that fall outside the expected range of values in the reference time interval:

< 6 : Low
6-10: Medium
>10: High

Special days: Days on which a KPI trend is affected by seasonality factors such as holidays, vacation, business cycles, recurring events.

To set a time interval, run the following steps:

Procedure

Modify the Start Date and End Date current values, or select the new start date and end date directly on the calendars. To set an interval within a single day, select the same day on both calendars.
Modify the Start Time and End Time current values.
Click Apply.

Results

A graph with the KPI trend in the new time interval is displayed.

Setting multiple time intervals

About this task

The Multiple interval section contains the following fields:

Start Time
Interval duration (days + hours)
End Time

When you first open the Datepicker panel, these fields are set to the current time interval values in the KPI graph.

You can customize up to five intervals for comparison.

A calendar widget is provided to assist you in setting intervals. The calendar highlights:

Anomaly %

The percentage of observed KPI data points that fall outside the expected range of values in the reference time interval:

< 6 : Low
6-10: Medium
>10: High

Special days: Days on which a KPI trend is affected by seasonality factors such as holidays, vacation, business cycles, recurring events.

To set multiple time intervals (up to five), run the following steps:

Procedure

Modify the Start Time and Interval duration values. The End Time value updates automatically.
For each time interval that you want to set, fill in the Starting Date field or use the calendar to set it.
Click Add new interval to set a new time interval.
When you have set all the desired time intervals, click Apply.
Select Reset to default to return to the original time interval, or Close to close the Datepicker panel.

Results

A graph with the KPI trend in the multiple time intervals is displayed.

Note: In the graphs showing KPI trends in multiple time intervals, the gray area representing the expected KPI values in each time interval is not displayed. On hovering over the KPI trends, a popover window displays the following information:

Observation time
KPI observed value for each time interval