This topic discusses dynamic baselines and how AppDynamics learns to detect performance anomalies using baselines.

Anomalies in Application Performance

A complex distributed application has a large number of performance metrics and each metric is important in one or more contexts. In such environments, it is difficult to:

manually determine the values or ranges that can be considered normal for a particular metric.
set meaningful thresholds in order to receive relevant alerts.
maintain a sense of what is a "normal" metric when the application or infrastructure undergoes change.

For these reasons anomaly detection based on dynamic baselines is one of the most important features in AppDynamics.

AppDynamics automatically calculates dynamic baselines for all of your metrics, which, based on actual usage, define what is "normal" for each metric. Then AppDynamics' anomaly detection uses these baselines to identify any subsequent metrics whose values fall out of this normal range. Static thresholds that are both tedious to set up and, in rapidly changing application environments, too often error-prone, are no longer needed. Anomaly detection can be applied to all AppDynamics metrics.

Baselines are not available immediately upon start-up. It takes a certain amount of time and load for AppDynamics to collect data and create its initial baselines, depending on the type of baseline being used. The longer the time frame required by the trend-type, the longer it takes for a fully functional baseline to be set up.

How Anomaly Detection Works

AppDynamics creates baselines by collecting metrics from your application over defined periods of time. This establishes what is "normal" for your application.

You define what constitutes an "anomaly" for your purposes by setting performance thresholds and establishing health rules in relation to those baselines. An anomaly is any metric that deviates a certain amount from a particular baseline, either in terms of standard deviations, percentages, or set values.
AppDynamics monitors these performance and behavior levels automatically. It can notify you in multiple ways and it can even direct remedial action.

Defining Baselines

Different baseline types can be useful in different situations. You select the type of baseline you wish to use by using two variables:

The time period that should serve as the base
The way the data collected during the time period should be segmented and sorted

The Base Time Period

The base time period, whose data is used to establish the baseline, can be defined in two different ways:

A fixed time range - from some specific date and time to a second specific date and time. For example, if you have a release cycle at a specific time you might limit your data collection to that specific time.
A rolling time range, in which the most recent x number of days is always used. This is the more common choice.

Trends: Data Segmentation

As the data is being collected, it can be segmented in four different ways. AppDynamics calls these segmentation patterns trends.

No trend: all data collected in the base time period is evaluated in the same set. This produces a baseline that is a flat average over the entire time period.
Daily: all data collected in the base time period is broken down into sets based on the hour of day they were collected. This produces a baseline that can vary based on the hour of day.
Weekly: all data collected in the base time period is broken down into sets based on the hour of day and the day of the week. This produces a baseline that can vary based on the hour of day combined with the day of the week.
Monthly: all data is broken down into sets based on hour of day and day of the month. This produces a baseline that can vary based on the hour of day combined with the day of the month.

Choosing Trend Types

You should choose the trend types that are most useful to you based on the use patterns of your application. For example, many applications have periodic load patterns:

A retail application may experience heavier traffic on the weekend than the rest of the week.

A payroll application may experience higher load at the beginning and end of the month compared to the rest of the month.

A Customer Relationship Management (CRM) application may experience heavy load during business hours Monday - Friday, but relatively light traffic over the weekend.

In each of these cases, using the no trend trend-type would likely produce a less effective baseline, because it would be skewed by periods of low application load. Match the trend type to your load type to ensure that AppDynamics determines the relevant baseline.

It may be that some of metrics you are interested in follow different periodic patterns. In this case you can define multiple baselines. You can configure any one of those baselines to be the default baseline for defining performance health rules.

Preconfigured Baselines

AppDynamics provides four preconfigured baselines. To see them, click Configure->Baselines in the left navigation bar.

The Baselines view opens:

The four baselines are as follows:

All Data - Last 15 days - This baseline is calculated using a rolling time range over the last 15 days using the no trend trend type.

It allows you to compare the value of a particular metric to the value of all such metrics captured during the last 15 days.
Daily Trend - Last 30 Day - This baseline is calculated using a rolling time range over the last 30 days using the Daily trend type.

It allows you to compare the value of a particular metric at a particular hour of the day to the baseline value of all such metrics captured during that hour for the last thirty days.
Weekly Trend - Last 90 Days -This baseline is calculated using a rolling time range over the last 90 days using the Weekly trend type.

It allows you to compare the value of a particular metric at a specific hour of the day on a specific day of the week to the baseline value of all such metrics captured during that hour of the day and day of the week for the last 90 days.
Monthly Trend - Last 365 Days - This baseline is calculated using a rolling time range over the last 365 days using the Monthly trend type. .

It allows you to compare the value of a particular metric at a particular hour of the day for a particular day in the month to the baseline value of all such metrics captured during that hour of the day and day of the month for the last 365 days.

Selecting and Configuring the Best Baselines for Your Application

Use the following options to configure baseline patterns in your environment:

Using a Preconfigured Baseline

If your application load patterns match one of the out-of-the-box patterns, use that.

Changing Existing or Creating New Baseline Patterns

If your application load patterns do not match one of the preconfigured patterns, you can change the values of an existing baseline or create completely new ones. For instructions, see Configure Baselines.

Using Baselines, Health Rules, and Alerts to Proactively Identify Performance Problems

Once you have set up your baselines, you can create health rules that use those baselines. For more information, see Health Rules. The baseline you wish to use for most of your health rules is called your default baseline, but you can use any baseline you have set up as the basis for any health rule. You can then define policies tied to those health rules to trigger alerts or other remedial actions to let you know when performance problems are occurring or may be about to occur. See Alert and Respond.

Learn More

Behavior Learning and Anomaly Detection