Current Key Measurements and Associated Anomaly Detection Algorithms

This reference lists the documented key measurements A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents. and the anomaly An unexpected event or measurement that does not match the expected model. detection algorithms associated with them. Riverbed IQ Ops receives the current policy definitions from the analytics service at runtime. The web application does not contain a fixed metric-to-algorithm mapping.

The current web application labels the detector types as Status Change, Up Time Reset, Threshold, Baselining, Dynamic Threshold, Bounded Dynamic Threshold, and Fault. Fault detection is supported by the runtime policy model, but the documented mappings in the table do not associate it with a key measurement.

Each row identifies a measurement by Data Source, Entity, and Metric. A checkmark means the documented mapping associates that detector with the metric. Some metrics use more than one detector. For compounded detection, the platform generates an incident only when both detectors identify anomalous behavior.

View current policies

Navigate to the Analytics & Threshold Configuration page:

1. Click System (the gear icon) at the bottom of the left menu.

2. Open Analytics.

The page organizes policies into Devices, Interfaces, Applications, Application Activities, and Health Events. Review the Analytics and Configuration columns for the current detector and settings. For descriptions of the detectors, see Ingest & Analytics: Indicators.

Documented mappings

Riverbed IQ Ops Analytics Pipeline Quick Reference

Data Source	Entity	Metric	[1] Status Change	[2] Up Time Reset	[3] Threshold	[4] Baselining	[5] Dynamic Threshold	[6] Bounded Dynamic Threshold
Riverbed NetProfiler	Application / Client Location	User Response Time1
		MoS
	Interface	In Utilization			3	3
		Out Utilization			3	3
Riverbed AppResponse	Application / Client Location	User Response Time1
		Throughput2
		% Retrans Packets
		% Failed Connections
Riverbed NetIM	Device	Device Status
		Device Uptime
	Interface	Interface Status
		In Packet Error Rate
		Out Packet Error Rate
		In Packet Drops Rate
		Out Packet Drops Rate
		In Utilization			3	3
		Out Utilization			3	3
Aternity	Application / Client Location	Activity Network Time
		Activity Response Time
		Page Load Network Time
		% Hang Time
Notes:
1 - [Metric: User Response Time] is: an approximation of Riverbed AppResponse [user-response-time] because Riverbed NetProfiler does not yet account for [connection_setup_time], while Riverbed AppResponse does, i.e. Riverbed AppResponse User Response Time calculation: [user-response-time] = ([connection_setup_time] / [connection_setup_time_n]) + ([request_network_time] / [request_network_n]) + ([response_network_time] / [response_network_n]) + ([server_delay] / [server_delay_n]) Riverbed NetProfiler User Response Time calculation: [user-response-time] = ([connection_setup_time] / [connection_setup_time_n]) + ([request_network_time] / [request_network_n]) + ([response_network_time] / [response_network_n]) + ([server_delay] / [server_delay_n]) User Response Time is only processed for "named" applications (e.g. excludes: ICMP, SNMP, TCP_Unknown, and UDP_Unknown). 2 - [Metric: Throughput]: only monitored for VoIP-related applications: {VOIP, SIP, RTP}. 3 - [Anomaly Detection Algorithms]: for compounded anomaly detection algorithms, the platform generates an incident only when both algorithms detect anomalous behavior.