Welcome to Application Delivery Analysis › Measure Performance › Thresholds, Incidents, and Incident Responses

Thresholds, Incidents, and Incident Responses

A threshold is the upper boundary of acceptable performance. Thresholds are important for these reasons:

• Thresholds enable the management console to rate data.
• Thresholds contribute to incident creation and the resultant incident responses and investigations that enable timely troubleshooting and problem resolution.

Thresholds exist by default for each application. The management console administrator sets thresholds for network and server performance. For each metric, you define a Minor (yellow) threshold, a Major (orange) threshold, and the minimum observations required to show the performance degradation.

The management console calculates default thresholds. It does not use baselines to calculate thresholds, it computes thresholds and baselines independently from the same data. Administrators can change thresholds to make them more or less sensitive to performance changes.

When thresholds are crossed, the management console creates incidents and launches configured incident responses. You can configure incident responses for each network, server, application, or monitoring device incident type. The management console includes a default incident response for each incident type.

The management console administrator can set up actions and notifications in response to each threshold that is met or violated for a specified time period. For a given incident response, the Administrator can specify an action or notification to occur in the following circumstances:

• When performance meets or exceeds the Minor threshold
• When performance meets or exceeds the Major threshold

The management console opens an incident for each condition. If an action exists for the condition, the management console launches that action automatically.

Remember the following details about incidents, incident responses, and actions:

• The management console creates incidents when thresholds are crossed.
• Incidents do not automatically trigger actions unless the following conditions are met:
  • The appropriate incident response is associated with the network, server, application, or monitoring device. You set the association when you create the incident response.
  • The associated incident response has associated actions. Default incident responses do not have associated actions.
  • The violation exceeds minimum severity and duration criteria.
• It is possible to have incidents without actions.
• It is possible to launch actions without incidents. An action associated with an incident is called an investigation, which you can launch manually or schedule.

Incidents and incident responses are useful for troubleshooting in the following ways:

• Incidents maintain a record of conditions when a problem occurs.
• Incident responses automatically gather information that help you troubleshoot a problem when it occurs and thereby reduce the mean time to repair (MTTR).

An incident response is a set of zero or more actions. An action can be a notification or an automatic investigation. For information about the types of incident responses you can create, see the Administrator Guide.