Self Tuning Thresholds (STT’s) have been around since Operations Manager 2007 released. I admit that most of my exposure to them has been on the tuning side of things – identifying management packs where STT’s were implemented and were noisy in a client environment. Kevin Holman has a good blog post on this topic at: http://blogs.technet.com/b/kevinholman/archive/2008/03/19/self-tuning-thresholds-love-and-hate.aspx.

Tuning & Overrides of STT’s

It wasn’t until OpsMgr 2012 however that I really started thinking about the potential benefits and challenges with STT’s. The biggest challenge when they were released was a lack of documentation on how to tune STT’s which oftentimes resulted in a choice to disable the monitor. A quick synopsis on how overrides work for STT’s is below:

The key to tuning STT’s is the inner sensitivity values which can be changed with an override. The override values for STT’s are:

  • Low = 4.01
  • Low-Mid = 3.77
  • Mid = 3.29
  • Mid-High = 2.81
  • High = 2.57

Or represented by a picture: (from https://www.catapultsystems.com/cfuller/archive/2010/02/09/tip-when-creating-a-self-tuning-threshold-in-opsmgr.aspx)
clip_image001

Visualizing STT’s

The second big challenge with STT’s is understanding when they will and will not alert. I ran across a great trick in the OpsMgr 2007 Unleashed book which mentioned the Performance view and the option to right-click on the view and choose the option to “Show Baseline” as shown below: (note, this option is unchecked by default)

image

Using the Show Baseline option in the performance view for a performance counter that uses STT’s, we can see the window around the value which indicates that it would not alert in the window. The example below shows an STT which was created for the Processor Utilization counter and defined with a low sensitivity and gathered baseline information for one day.

image

An example of this performance monitor in a mid-high level is shown below: (note how small the size of the range is around the performance counter shown on the right hand side of the performance view)

image

To see the variation in the STT window, I created an override to set the sensitivity to low as shown below. Note the right side of the graph where the acceptable range for the counter is shown has increased in size around the performance counter when compared to it at a higher level of sensitivity.

image

The performance view can also be set to project this performance counter forward. As an example, as I am configuring this performance view on 7/14/2012 I can se the time range from 7/12 until 7/15 (one day into the future) as shown below.

image

The result is shown below which projects what the counter acceptable range will be over the future period as shown below. The black performance counter has already been collected, but the area on the right shows the expected performance counter range without the actual performance counter even collected yet!

image

Summary: If you are using STT’s and want to see what the acceptable value range is for them, use a performance view. Set it to display at least double the amount of the baseline timeframe and use the “Show Baseline” option.

Good additional readings on this topic include:

Daniel Mueller spelled this out extremely well for OpsMgr 2007 at: http://blogs.technet.com/b/daniels_opsmgr_blog/archive/2011/04/17/showing-baseline-in-opsmgr-performance-view.aspx

http://technet.microsoft.com/en-us/library/dd789011.aspx

http://social.technet.microsoft.com/wiki/contents/articles/237.aspx

And the upcoming System Center 2012 Operations Manager Unleashed book!