[BBLISA] More on SNMP statistical prediction & problem detection

[Alex Aminoff]

On 8/9/2013 4:19 PM, Marc Chiarini (school) wrote:
> There is a very important academic & practical discussion to be had 
> about this.  In fact Alva Couch and I and others have been examining 
> similar topics for years.  Unfortunately I don't have the bandwidth 
> right now to get into it, perhaps in a few months.  I'll leave you 
> with these two tidbits:  thresholds are no good in these circumstances 
> (except as a coarse lower/upper bound)...you need to combine learning 
> (small amounts of hysteresis) and highly reactive management.  Second, 
> one might be able to obtain unrefined but useful estimates of 
> performance in various components (e.g., cpu, disk, network, etc) 
> without an agent -- via analysis of response-time and other 
> statistics...essentially building a black-box model over time of how 
> the system is *expected* to work.
>
> Regards,
> Marc

Thanks for this tidbit.

I read the slides from your 2009 paper, 
http://www.cs.tufts.edu/~couch/publications/mace-09-slides.pdf

Not sure I understood the details, but enough to move forward.

I presume you are aware of the work that Jake Brutlag did and added to 
RRDTool, presented at

https://www.usenix.org/legacy/events/lisa00/full_papers/brutlag/brutlag_html/

He implemented the Holt-Winters algorithm for time-series modeling. I'm 
going to use that because it's already been done for me.

So the only thing I'm going to add is a meta-analysis where you collect 
say 10 SNMP variables from 10 switches each of which has 24 ports, total 
2400 time-serieses, and then ask the question do enough of these differ 
from their predicted values enough to indicate a systemic problem.

My question is, does anyone have a suggestion for what statistical 
method to use for the meta-analysis? In your paper, it looks like you 
were only looking at one time-series at a time: has anyone looked at how 
to sensibly combine? Alternatively, I have not looked closely at what 
you can get from the Holt-Winters stuff in RRDTool - has anyone used 
that for any purpose?

  - Alex Aminoff
    BaseSpace.net & NBER


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.bblisa.org/pipermail/bblisa/attachments/20130813/aa81a8a3/attachment.htm