Settings Tab

The Settings tab presents options for automatic monitoring (baseline alerting). To access this tab, go to netwitness_adminicon_25x22.png (Admin) > Event Sources > Settings.

Workflow

This workflow shows the overall process for configuring event sources.

netwitness_111_06_cfgautoalerts.png

What do you want to do?

Role I want to... Documentation

Administrator

View and modify event sources.

Managing Event Source Groups

Administrator

Acknowledge and map events sources.

Acknowledging and Mapping Event Sources

Administrator

Add and configure parser mappings for a Log Decoder

Manage Parser Mappings

Administrator

View event source alarms.

Viewing Event Source Alarms

Administrator

*Configure Automatic Alerts.

Automatic Alerting

Administrator

Troubleshoot event source management.

ESM Troubleshooting & Appendix

*You can perform this task here.

Related Topics

Automatic Alerting

Disabling Notifications

Quick Look

You can set up policies and thresholds for your event source groups. You do this so that you can receive notifications when the thresholds are not met. NetWitness also provides an automatic way to receive alarms, if you do not want to set up thresholds to generate alarms.

About Automatic Alerting

You can set up policies and thresholds for your event source groups. You do this so that you receive notifications when the thresholds are not met. NetWitness also provides an automatic way to receive alarms, if you do not want to set up thresholds to generate alarms.

To trigger automatic alerts, you can use baseline values. This way, you do not need to set up numerous group thresholds and policies in order to receive alerts. Any anomalous amount of messages trigger alerts, without needing to do any configuration (except for turning on automatic alerting).

Note the following:

  • After you begin collecting messages from an event source, it takes the system approximately a week to store a baseline value for that event source. After this initial period, the system alerts you when the number of messages for a period are above or below the baseline by a set amount. By default, this amount is 2 standard deviations above or below the baseline.
  • Base your high and low deviation settings on how "regular" your event sources behave. That is, if you expect little or no variance in the number of messages that arrive for a given time (for example, 8 to 9 am on a weekday), then you can set a low value for the Deviation. Conversely, if you often see peaks and valleys, set the Deviation value higher.
  • If you enable a policy, but do not have any thresholds set, then you can still receive automatic (baseline) notifications, as long as you have turned on automatic alerting.

Note: Automatic alerting, and it settings, are currently in Beta testing.

netwitness_settb1.png

1 Determines whether automatic alerting is on or off. By default, this option is selected (automatic alerting turned on)
2

Determines whether notifications for automatic alerts are on or off. By default, this option is cleared (automatic notifications are not sent when automatic alerts are triggered)

3

The standard deviations below which to receive alerts. Default is 2.5 (95% confidence)

4

The standard deviations above which to receive alerts. Default is 2.5 (95% confidence)

5

When selected, this option stores event source counts per one-hour interval. The data that is collected is used to form the baseline values for each event source.

  • Enabled (default): one count per hour per event source is stored in the underlying database. These one-hour counts (or aggregations) form the historical basis for computing the normal range for each event source.
  • Disabled: when the SMS Server is restarted, Event Source Monitoring will have no historical data with which to compute the normal range and the user will have to wait until enough data (about a week's worth) is collected to form a new basis for each event source
6 Controls how much historical data (see Enable Aggregation Persistence) to maintain for each event source. The default value of 120 days means roughly 4 months of history is kept and used when reconstructing the basis for each event source
7

When enabled, data about the behavior of the automatic alerting is stored to disk. The default value is Enabled.

The data retained includes baseline value over time and the alerting history for each event source. Note, however, the event source address and type is anonymized, so only your event rate information is revealed.

Since automatic alerting is a beta feature, this data is important to measure the efficacy of the feature. This can be disabled without affecting the automatic alerting functionality

8 The Reset option discards any unsaved changes for all settings on the page.
9 Click Apply to save any changes you made to the values on the page.

Features

The Settings tab contains the following features.

Feature Description
Enable Automatic Monitoring

Determines whether automatic alerting is on or off. By default, this option is selected (automatic alerting turned on)

Enable Notifications From Automatic Monitoring

Determines whether notifications for automatic alerts are on or off. By default, this option is cleared (automatic notifications are not sent when automatic alerts are triggered)

Low Standard Deviations

The standard deviations below which to receive alerts. Default is 2.5 (95% confidence)

High Standard Deviations

The standard deviations above which to receive alerts. Default is 2.5 (95% confidence)

Enable Aggregation Persistence

When selected, this option stores event source counts per one-hour interval. The data that is collected is used to form the baseline values for each event source.

  • Enabled (default): one count per hour per event source is stored in the underlying database. These one-hour counts (or aggregations) form the historical basis for computing the normal range for each event source.
  • Disabled: when the SMS Server is restarted, Event Source Monitoring will have no historical data with which to compute the normal range and the user will have to wait until enough data (about a week's worth) is collected to form a new basis for each event source
Aggregation Persistence Interval in Days

Controls how much historical data (see Enable Aggregation Persistence) to maintain for each event source. The default value of 120 days means roughly 4 months of history is kept and used when reconstructing the basis for each event source

Enable Generation of Analytics

When enabled, data about the behavior of the automatic alerting is stored to disk. The default value is Enabled.

The data retained includes baseline value over time and the alerting history for each event source. Note, however, the event source address and type is anonymized, so only your event rate information is revealed.

Since automatic alerting is a beta feature, this data is important to measure the efficacy of the feature. This can be disabled without affecting the automatic alerting functionality

Reset

This option discards any unsaved changes for all settings on the page.

Apply

Click Apply to save any changes you made to the values on the page.