<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 8/9/2013 4:19 PM, Marc Chiarini
(school) wrote:<br>
</div>
<blockquote
cite="mid:CAKjnc+LnJNhurzo3sFDw7ReENFVL3wJpqPCTybxQxOZyyr=WXw@mail.gmail.com"
type="cite"><font><font face="verdana,sans-serif">There is a very
important academic & practical discussion to be had about
this. In fact Alva Couch and I and others have been examining
similar topics for years. Unfortunately I don't have the
bandwidth right now to get into it, perhaps in a few months.
I'll leave you with these two tidbits: thresholds are no
good in these circumstances (except as a coarse lower/upper
bound)...you need to combine learning (small amounts of
hysteresis) and highly reactive management. Second, one might
be able to obtain unrefined but useful estimates of
performance in various components (e.g., cpu, disk, network,
etc) without an agent -- via analysis of response-time and
other statistics...essentially building a black-box model over
time of how the system is *expected* to work.</font></font>
<div>
<font face="verdana, sans-serif"><br>
</font></div>
<div><font face="verdana, sans-serif">Regards,</font></div>
<div><font face="verdana, sans-serif">Marc</font><br>
</div>
</blockquote>
<br>
<font face="verdana, sans-serif">Thanks for this tidbit.<br>
<br>
I read the slides from your 2009 paper,
<a class="moz-txt-link-freetext" href="http://www.cs.tufts.edu/~couch/publications/mace-09-slides.pdf">http://www.cs.tufts.edu/~couch/publications/mace-09-slides.pdf</a><br>
<br>
Not sure I understood the details, but enough to move forward.<br>
<br>
I presume you are aware of the work that Jake Brutlag did and
added to RRDTool, presented at<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.usenix.org/legacy/events/lisa00/full_papers/brutlag/brutlag_html/">https://www.usenix.org/legacy/events/lisa00/full_papers/brutlag/brutlag_html/</a><br>
<br>
He implemented the Holt-Winters algorithm for time-series
modeling. I'm going to use that because it's already been done for
me.<br>
<br>
So the only thing I'm going to add is a meta-analysis where you
collect say 10 SNMP variables from 10 switches each of which has
24 ports, total 2400 time-serieses, and then ask the question do
enough of these differ from their predicted values enough to
indicate a systemic problem. <br>
<br>
My question is, does anyone have a suggestion for what statistical
method to use for the meta-analysis? In your paper, it looks like
you were only looking at one time-series at a time: has anyone
looked at how to sensibly combine? Alternatively, I have not
looked closely at what you can get from the Holt-Winters stuff in
RRDTool - has anyone used that for any purpose?<br>
<br>
- Alex Aminoff<br>
BaseSpace.net & NBER<br>
<br>
<br>
</font>
</body>
</html>