Skip to content
CA Application Performance Management - 10.5
Documentation powered by DocOps

Configure Differential Analysis

Last update July 25, 2018

Differential Analysis is active by default. However, as an administrator you configure the default settings, or create and configure Differential Analysis elements. As an application triager, you monitor performance using the information in the Differential Analysis map or chart.

Perform the following steps:

  1. Verify the Differential Analysis prerequisites.
  2. Create a differential control.
  3. Configure a differential control.
  4. Configure a metric grouping.
  5. Configure a simple alert from a management module.
  6. (Optional) Tune the configuration:

Verify the Differential Analysis Prerequisites

Before you implement Differential Analysis, verify that your CA APM implementation includes:

  • An Enterprise Manager
  • Agents that are configured for application frontends, backends, business transactions, or all.
  • WebView
  • For the CA CEM installation, you have installed a Transaction Impact Monitor (TIM).

    Note: You can have one or more TIMs in a CA CEM environment.

Create a Differential Control

Differential controls are elements that detect instability in matching metrics. Caution thresholds and danger thresholds control variance intensity, which is a measure of the stability for the metric. This behavior makes differential controls different from traditional alerts that combine a state of green, yellow, and red and imply that problems exist. Differential controls let you determine how much instability must be registered to enter caution and danger variance intensity zones. The advanced options provide even more control over Differential Analysis variance intensities. In general, Differential Analysis users can apply low thresholds and view the full feed of stability changes, or use high thresholds and limit the output to a trickle of only the most extreme changes (which are most likely to indicate a problem).

We recommend that you start with the default thresholds and change the default alert threshold settings to indicate the intensities at which you would like a notification.

The Differential Analysis map only appears for a metric if a differential control exists for the metric. You create a differential control element in a management module matching your metric. Management modules can exist for each domain or in all domains and they contain elements that organize metric data for presentation in WebView. CA APM includes a preconfigured differential control for all frontends and business transactions.

Follow these steps:

  1. In WebView, click Management.
  2. Select Elements, New Differential Control.
    The New Differential Control dialog appears.
  3. Complete the following options and click OK. The following fields require explanation:
    • Name
      Specifies a name for the element.

      Note: To identify the source of an element, use a descriptive name.
    • Force Uniqueness
      Appends a number to the name when the same name exists within the management module.
    • Management Module
      Specifies a management module for containing the element.

    The element appears under the differential control node in the management module that you specified. The editor appears in the Preview pane.

    Important! In the Workstation, no differential control elements appear. In WebView, you can create, read, update, and delete the differential control elements.

Configure a Differential Control

A differential control management module lets you use a common configuration for Differential Analysis, such as actions for caution and danger states.

Note: The Management Modules include a preconfigured differential control for all frontends and business transactions. You can edit this module that is named Default Differential Control.

Follow these steps:

  1. In WebView, click Management.
  2. In the tree, navigate to Management Modules, <Management Module>, Default Differential Control.
  3. Select the metric group that you want to configure for a differential control, for example: Frontend URLs and BTs Average Response Time.
  4. Adjust the thresholds by using the Danger and Caution sliders. The top (very high value) of the one slider automatically adjusts the bottom (very low value) of the other slider. Configure more caution and less danger, or more danger and less caution: Caution very high equals Danger very low. The generated thresholds from the slider values auto-adjust to the window length.
    The following graphic shows a quick reference for Differential Analysis.
  5. (Optional) Click Advanced and complete the options:
    • Rule Application
      Specifies a rule for triggering spikes:
      1 Any single data point falls outside the 3σ limit from the centerline.
      2 Two out of three consecutive points fall beyond the 2σ limit.
      3 Four out of five consecutive points fall beyond the 1σ limit.
      4 Ten out of ten consecutive points increasing or decreasing.
    • Window Length
      Specifies the number of previous 15-second cells that influence the weight of a window. The total weight of the window determines caution or danger regions. Each cell in the window contains the largest weight of all rules that are broken in that 15-second period, minus any decay. The oldest cell is aged out and dropped as new cells are added.
      Default: 20
    • Decay
      Specifies the rate at which the breached rules decay with their cell over time. As new cells are added, decay reduces the effect of the previously added weights in the window. The newest one is always full weight. Based on the decay value, only parts of old weights are considered for final calculation. So each cell in the window has a reduction percentage following the decay level. Based on that reduction percentage value, the weights are reduced on each new instance addition to the window.

      100 represents the fastest decay—rule breaches drop in value quickly as they age. From newest to oldest, the cells have progressive reductions from 0 to 100 decay in their weights. For example, oldest cells have complete reduction in their weight. This setting reduces the likelihood of caution and danger notification, especially when a period of instability passes quickly.

      0 represents the highest sensitivity (no decay)—breaches maintain their full value over the entire window: oldest has the same value as it did when it was newest. Using this setting, a short period of instability can keep the spike in a caution or danger state until it has aged out completely from the window.

      The default value is 20. Recent rule breaches are worth moderately more than older rule breaches.

  6. Click Apply.
    The differential control for a baseline is configured.

Configure a Metric Grouping

You use the Perl regular expression standard for configuring metric groupings. A regular expression is a text string that describes a search pattern. Wildcards let you condense the collection of objects to a short expression.

Follow these steps:

  1. In WebView, click Management.
  2. Navigate the Management Modules tree to the Metric Groupings node which includes the metric grouping that you want to configure, for example: Default differential analysis metric grouping.
  3. Click the metric grouping.
    The Preview pane appears.
  4. Select one of the following options. The following fields require explanation:
    • Use Management Module Agent Expressions
      Defines the use of agent expressions that are defined at the management module level, for example: (.*)\|(.*)\|(.*)
    • Use Metric Grouping Agent Expressions
      Defines the use of agent expressions at the metric grouping level. Each metric grouping can have its own set of agent expressions.
  5. Enter a regular expression:
    • Metric Grouping Agent Expressions
      Specifies a regular expression in Perl 5 that filters input to the metric by specifying the data up to and including the agent name.
      This expression determines to which agents the grouped data is limited. For example, the expression (.*)\|WPS2-0[1,2] looks for any agents in all domains that are named WPS2-01 or WPS2-02. The agent expression is important when multiple JVMs report to the same Enterprise Manager, but serve different purposes such as different websites in the same corporation. In this case, you use a regular expression to limit which agents your metric grouping filters.

      Note: These fields are disabled when you select the Use Management Module Agent Expressions option.
    • Metric Expressions
      Specifies a regular expression in Perl 5 that specifies the resource (the chain of folders leading to the metric) and the metric. For example:
      Frontends\|Apps\|[^|]+\|URLs\|[^|]+:Average Response Time\(ms\) looks for all URLs for frontends and only for the Response Time (ms) metric.
      Business Service\|[^|]+\|Business Transactions\|.*:Average Response Time\(ms\) looks for CEM business transaction metrics coming from the TIM and only for the Response Time (ms) metric.

      Backends\|WebService at [^|]+\|Paths\|[^|]+:Average Response Time \(ms\) looks for webservice backends called by any frontends.

      Similarly Backends\|System [^|]+ on port [^|]+:Average Response Time \(ms\) looks for socket backends.


      The following expressions are for metrics under custom business application agents. The Team Center map uses these expressions to show Differential Analysis intensity on nodes (the end-user application perspective).
      By Frontend\|[^|]+\|Health:Average Response Time \(ms\) looks for aggregated frontend Response Time (ms) metrics.
      By Backend\|[^|]+\|Health:Average Response Time \(ms\) looks for aggregated Response Time (ms) metrics of backends.
      By Business Service\|[^|]+\|[^|]+\|[^|]+:Average Response Time \(ms\) looks for aggregated business transaction metrics.
  6. Click Add.
    An additional field opens so you can enter a regular expression for Metric Grouping Agent Expressions and Metric Expressions.
  7. Click Remove.
    If more than one set of expressions are available, you can remove them. One expression must exist in the metric grouping definition. In this case, Remove is disabled.
  8. Click Apply.
    The metric grouping is configured.

Create a Simple Alert for a Variance Intensity Metric

You can create a simple alert for the Average Response Time (ms) Variance Intensity metric for differential analysis and define the conditions under which the alert is triggered.

Follow these steps:

  1. In WebView, click INVESTIGATOR.
  2. Navigate the Metric Browser to the Variance folder and then the subfolders to the Average Response Time (ms) Variance Intensity metric.
  3. Right-click Average Response Time (ms) Variance Intensity and select New Simple Alert From Metric "Average Response Time (ms) Variance Intensity".
  4. Complete the fields in the Create New Simple Alert From Metric dialog and click OK.
    The alert appears in the Alerts folder in the MANAGEMENT tab.
  5. On the MANAGEMENT tab, navigate to Alerts.
  6. Click Average Response Time (ms) Variance Intensity for the alert that you created in Steps 3 and 4.
  7. Adjust the alert values to ensure that you get all matching metrics.
  8. Enable Notify By Individual Metric to get notifications by app.
  9. Set up your Danger and Caution thresholds, 20/30 or 25/35. Adjust the number of threshold and observed periods to use for the metric evaluation. The thresholds should conform with how Differential Controls are scored based upon the Western Electric Rules. Consider using the Description to inform others about how the values are set.
  10. Use the Action Delay with a reasonable window to ensure that you do not send too many notifications.
  11. To use this alert for multiple applications, modify the metric grouping that you created for the simple alert. Make adjustments to the agent and metric expressions to ensure that you gather metrics from all expected agents.

Note: For screenshots, see the knowledge document KB000010435.

Create a Simple Alert From a Metric Grouping

You can create a simple alert from a metric grouping for differential analysis and define the conditions under which the alert is triggered.

Follow these steps:

  1. In WebView, click MANAGEMENT.
  2. In the tree, navigate to Management ModulesDefaultMetric GroupingsDifferential Analysis Metrics.
  3. Right-click Differential Analysis Metrics and select New Simple Alert From Metric Grouping "Differential Analysis Metrics".
  4. Complete the fields in the Create New Simple Alert From Metric Grouping dialog and click OK.
    The alert appears in the Alerts folder.

Configure a Simple Alert From a Management Module

You can configure a default simple alert for differential analysis and define the conditions under which the alert is triggered.

Follow these steps:

  1. In WebView, click Management.
  2. In the tree, navigate to Management Modules, Differential Analysis, Alerts.
  3. Click Default Differential Analysis Alert.
    The Preview pane shows the default values for the alert.
  4. (Optional) Change the following options:
    • Resolution
      Specifies the time period resolution in hours, minutes, or seconds.
      An alert uses input data from a selected metric grouping. For the time resolution, the alert gathers information and summarizes a value for that time period. The resulting value depends on the type of data in the metric. For example, if the metric is a rate, the summarized value is the average rate during that time period. Or if the metric is a counter, it produces the most recent value of the counter.

      Note: Time resolution values must be in 15-second increments.
    • Combination
      Specifies whether an alert is triggered when a metric exceeds a threshold (any) or all metrics exceed a threshold (all).

      Note: The Combination field is ignored when the Notify by individual metric check box is selected.
    • Comparison Operator
      Specifies the condition in which the alert is triggered. The comparison operator relates to the danger and caution threshold values.
    • Notify by Individual Metric
      Triggers individual metric alerts. You can use the individual metric alert notification and resolution alert together.
    • Trigger Alert Notification
      Triggers an alert notification when a problem or resolution state is detected. Select one of the following options:
      • Each Period While Problem Exists -- This option produces a problem message every period that the simple alert is in caution or danger.
      • When Severity Increases -- This option produces a problem message on any period when the state of the alert escalates.
      • Whenever Severity Changes (resolution alert) -- This option produces problem or resolution messages on any state transition.
      • Report Only Final State Whenever Severity Changes (resolution alert) -- This option produces a problem or resolution message only for the final state of an alert transition.
  5. Set the threshold options for Danger and Caution alerts.
    • Threshold
      Specifies a value that triggers a danger alert or caution alert.

      Note: For Differential Analysis, the underlying metric is variance intensity, which has a range from 10 to 40. 10 - 20 is stable range. 20 - 30 is moderate instability. Over 30 is a period of severe instability. A good default can be 25 for Caution and 35 for Danger.
    These options set the ratio of excessive periods that must be met for CA Introscope to trigger the alert. For example, enter 8 and 10. The danger alert triggers only when the metric exceeds the danger threshold in eight of the ten observed periods.
    • Periods Over Threshold
      Specifies the maximum number of periods that the threshold can exceed before an alert is triggered.
    • Observed Periods
      Specifies the total number of periods being monitored for each alert iteration.
  6. Add actions to danger or caution conditions. Under either Danger actions or Caution actions in the settings pane, click Add.
    The Choose Action dialog appears and lists available actions.
  7. Select one or more actions and click Choose.

    Note: To select multiple actions, press the Ctrl key while selecting actions.

    The actions appear in the Actions list.

  8. In the list, select the alert that you want to test and click Test.
    A message appears for all the actions in the list.

    Note: Test messages appear only when the actions are active.
  9. Click Close on the message dialog.
    The actions are set for the alert.
  10. Enter the action delay time in hours, minutes.
  11. Click Apply.
    The simple alert configuration is set.

Reduce Notifications for a Frontend

You can reduce or stop the action notifications for a frontend by:

  • Excluding the specific frontend applications from Differential Analysis (which stops all notifications).
  • Excluding the specific frontend applications and then creating a separate differential control element specifically for that frontend (which allows fine-tuning of notifications).
Note: A simple way to reduce the number of notifications is to add actions to the danger list only.

Follow these steps:

  1. In WebView, click Management.
  2. In the tree, navigate to Management Modules, <Management Module>, Differential Control.
  3. Note the name of the metric group that you want to edit for a differential control, for example: Frontend Average Response Time.
  4. Navigate the Management Modules tree to the Metric Groupings node you noted.
  5. Click the metric grouping.
    The Preview pane appears.
  6. Select the Use Metric Grouping Agent Expressions option.
  7. Replace the values in the following fields:
    1. Use your existing agent expression.
    2. Enter a pattern in Metric Expressions.
      For example, this pattern excludes a frontend that is named Foo:

      Frontends\|Apps\|(?!Foo)\w+:Average Response Time \(ms\)

      To exclude more frontends, use a pipe character (|) to separate each frontend:

      Frontends\|Apps\|(?!Baz|Foo|Bar)\w+:Average Response Time \(ms\)

      If you have a frontend with a long name or special characters, use a unique, short prefix for the name instead of the entire name. If the prefix matches more than one name, all matching frontends are excluded.

  8. Click Apply.
    The metric grouping is configured to exclude the specified frontend applications. The frontends are not included in Differential Analysis and the map.

If you still want notifications but you want different differential control settings (for example, greater caution or danger thresholds), follow these steps:

  1. Exclude the frontend from the default metric grouping by performing the previous steps.
  2. Create a metric grouping that matches your frontend only.
  3. Create a differential control element that uses your new metric grouping, and then adjust the configuration as appropriate.

Increase the Metric Count Limit

Each collector has a default limit to the number of collected metrics. Differential controls have a default maximum of 20,000 metrics. If the limit is reached, no new metrics appear in the Differential Analysis map. You can increase the metric count limit for a differential control so that the metrics appear.

Follow these steps:

  1. In WebView, click INVESTIGATOR, Metric Browser.
  2. Navigate the tree to Variance.
  3. Select each of the management modules that have differential control elements and select the Metric Count tab for each one.
  4. Note the number that appears in the Metric Count column.
    The sum of these counts is the number of metrics that you have configured for analysis. If that number equals 20,000 metrics or greater, continue to the next step.
  5. Go to <EM_Home>/config and open the IntroscopeEnterpriseManager.properties file in a text editor.
  6. Locate the following section:

    ###############################################################################

    # Metric Baselining Settings

    # Configures values for the metric baseline engine.

  7. Increase the value in the following property, for example:

    introscope.enterprisemanager.baseline.max.metrics.baselined=21000

    Note: If a collector is at capacity and you lower this value, the number of metrics do not decrease immediately. The metrics decrease over time as metrics age out.
  8. Save and close the file.

Turn Seasonality On or Off

Differential Analysis uses previous data in 30-minute periods, 48 periods per day, and 336 (48 times 7 days) periods per week for seasonal prediction. For the first two weeks, the prediction is not seasonal. The third week starts seasonal prediction using the previous two weeks, and any invariant data appears as a variant in the map. You can turn seasonality on or off. Seasonality is on by default.

Follow these steps:

  1. Go to <EM_Home>/config and open the IntroscopeEnterpriseManager.properties file in a text editor.
  2. Change the introscope.enterprisemanager.baseline.core.seasonality.enabled property value to true or false.
  3. Save and close the file.
Was this helpful?

Please log in to post comments.

  1. Haruhiko Davis
    2017-07-11 06:53

    In the section, "Configure a Simple Alert From a Management Module", it mentions a management module called "Differential Analysis". There is no such module delivered with APM.

    1. Lucie Stehnova
      2017-07-12 10:46

      Hi Haruhiko,

      We corrected the section. 

      Thank you

      Lucie

  2. Michael Anthony ONeill
    2017-07-12 04:36

    Hi Haruhiko,

    Thanks for notifying us about this, we will work to get this resolved as soon as possible.

    Michael