Skip to content

Add an anomaly trigger

Use this procedure to create a new anomaly trigger. You must have the Manager role to create a trigger.

  1. Open the ADMIN > Actions page, and then click the TRIGGERS tab.

  2. In the upper-right corner, click ADD TRIGGER.

  3. The ADD TRIGGER dialog box opens.

    In the Trigger details section, enter the following information:

    1. In the Trigger name field, enter a name.

      Note that trigger names can't be changed after the ADD TRIGGER dialog box is saved.

    2. (Optional) In the Description field, enter text to describe the trigger.

    3. From the Type list, choose Anomalies.

      The ADD TRIGGER dialog box expands to include new fields.

    4. (Optional) In the Tags field, add one or more terms to associate with the trigger.

  4. In the Trigger criteria area, create a query to specify a key metric and, optionally, to identify one or more entities in your environment.

    1. In the first comparison, select the Metric name field for the left side, the equal to operator, and the name of a key metric that is being modeled for the right side.

      The anomaly detection service only trains models of a key metric when it finds enough historical data for the metric. To determine whether a metric is being modeled, open the Smart View page of an entity for which the metric is collected and look for confidence bands in graphs of the metric.

    2. (Optional) Add comparisons to identify entities in your environment.

    For more information, see Trigger queries and Anomaly trigger fields.

    Best Practice

    As a best practice, use Entity: Production State equal to Production as a trigger criteria. This criteria can prevent matches that are "false positives" against non-production entities.

    For example, include this criteria to avoid matching against devices that might be in Maintenance.

    To match on additional production states, consider using the greater than or greater than or equal to operators.

  5. In the Minimum score field, enter a threshold value for anomaly scores. When an anomaly score exceeds this value, the trigger matches.

    Typically, values lower than 0.99 yield irrelevant matches, so Zenoss recommends starting with 0.99. Then, raise the value to (for example) 0.995 to improve matches, if necessary.

  6. Click SAVE.