Detect Anomalies Using Dynamic Baselines

This topic describes dynamic baselines and how the AppDynamics platform automatically learns to detect performance anomalies using baselines that are specific to your application environment.

AppDynamics creates baselines by collecting metrics from your application over defined periods of time.  This establishes what is normal for your application.

You define what constitutes an anomaly by establishing health rules. An anomaly is a metric that deviates a certain amount from a particular baseline either in terms of standard deviations, percentages, or set values.  

AppDynamics monitors these performance and behavior levels automatically. It can notify you in multiple ways and it can even direct remedial action.

 Baselines are not available immediately upon start-up. It takes time and application load for the platform to collect data and create its initial baselines. The time depends on the type of baseline being used.  The longer the time frame required by the trend-type, the longer it takes for a fully functional baseline to be set up.

The following areas of the platform use baselines:

• Health rules
• Flow map colorization 
• Transaction analysis dashboards
• Metric graphs

Defining Baselines

Different baseline types can be useful in different situations. You select the type of baseline using two variables:

• Time period to use
• How to segment and sort the data collected during the time period

Base Time Period

You can define the base time period, whose data is used to establish the baseline, in two different ways:

• Fixed time range: from some specific date and time to a second specific date and time. For example, if you have a release cycle at a specific time you might limit your data collection to that specific time.
• Rolling time range: in which the most recent X number of days is used.  This is the more common choice. 

Trends: Data Segmentation

As the data is collected, it can be segmented in four different ways.  AppDynamics calls these segmentation patterns trends.

• No trend: all data collected in the base time period is evaluated in the same set.  This produces a baseline that is a flat average over the entire time period.  
• Daily: all data collected in the base time period is broken down into sets based on the hour of day they were collected.  This produces a baseline that can vary based on the hour of day.
  
  
  
  
• Weekly: all data collected in the base time period is broken down into sets based on the hour of day and the day of the week. This produces a baseline that can vary based on the hour of day combined with the day of the week.
  
  
  
  
• Monthly: all data is broken down into sets based on hour of day and day of the month.  This produces a baseline that can vary based on the hour of day combined with the  day of the month.
  
  

Choosing Trend Types

You should choose the trend types that are most useful to you based on the use patterns of your application.  For example, many applications have periodic load patterns:

• A retail application may experience heavier traffic on the weekend than the rest of the week.

• A payroll application may experience higher load at the beginning and end of the month compared to the rest of the month.

• A Customer Relationship Management (CRM) application may experience heavy load during business hours Monday - Friday, but relatively light traffic over the weekend.

In each of these cases, using the no trend trend-type would likely produce a less effective baseline, because it would be skewed by periods of low application load. Match the trend type to your load type to ensure that AppDynamics determines the relevant baseline.

It may be that some of metrics you are interested in follow different periodic patterns.  In this case you can define multiple baselines. You can configure any one of those baselines to be the default baseline for defining performance health rules.

Preconfigured Baselines

The AppDynamics platform provides preconfigured baselines.  To see them, click Configure->Baselines in the left navigation pane.

The Baselines view opens:

The baselines are as follows:

• All Data - Last 15 days - This baseline is calculated using a rolling time range over the last 15 days using the no trend trend type. 
  
  
  It enables you to compare the value of a particular metric to the value of all such metrics captured during the last 15 days.
  
  
• Daily Trend - Last 30 Day -  This baseline is calculated using a rolling time range over the last 30 days using the Daily trend type.  
  
  
  It enables you to compare the value of a particular metric at a particular hour of the day to the baseline value of all such metrics captured during that hour for the last thirty days. 
  
  
• Weekly Trend - Last 90 Days -This baseline is calculated using a rolling time range over the last 90 days using the Weekly trend type.  
  
  
  It enables you to compare the value of a particular metric at a specific hour of the day on a specific day of the week to the baseline value of all such metrics captured during that hour of the day and day of the week for the last 90 days.
  
  
• Monthly Trend - Last 365 Days - This baseline is calculated using a rolling time range over the last 365 days using the Monthly trend type.
  
  
  It enables you to compare the value of a particular metric at a particular hour of the day for a particular day in the month to the baseline value of all such metrics captured during that hour of the day and day of the month for the last 365 days.
  
  

Selecting the Best Baselines for Your Application

Use the following options to configure baseline patterns in your environment:

• Use a preconfigured baseline: If your application load patterns match one of the out-of-the-box patterns, use that.
• Change a preconfigured baseline or create new pbaseline pattern: If your application load patterns do not match one of the preconfigured patterns, you can change the values of an existing baseline or create completely new ones.