Access: WAE Live > Analytics, click New Report, and select Deviation Report Type
Access: WAE Live > Explore, select objects, and click Run Report
The deviation report detects sudden changes in property values. While the report can be applied to any high-frequency property value, such as nodes’ CPUs, the primary use is to detect rapid increases and decreases in LSP or interface traffic. Determining the timestamp can assist you in correlating other network or service events that may have caused a reported surge.
This detection of a deviation is based on how traffic has behaved in the past, which is considered to be the norm or the moving average. For instance, if traffic normally goes up and down within a specific band of Mbps, then this is normal traffic and would not be flagged as a deviation.
The moving average and range of acceptable tolerance for the property value are determined by two configurable fields, each of which creates corresponding lines in the graph.
- Size of Historical Window—Identifies how many past data points to use in the calculation of the moving average.
– The moving average, which appears in the graph, is how WAE Live expects the property value to change based on past behavior. This is calculated using Bollinger Bands.
– A data point is a point in time in which you collect data. So, for example, if you collect every 5 minutes and you want the moving average to be based on the last 24 hours, you would enter 288.
- Sensitivity—Identifies the tolerance range (standard deviation), which is how far from the moving average the raw data can be before it is flagged as a deviance: the higher the number, the higher the tolerance. This creates two lines that are equal distance on either side of the moving average line. If raw data crosses either the upper or lower band of tolerance, a deviance is recorded. See Figure 10-1 for an example.
You can also set a threshold under which property values are not considered for the deviation calculation, thus filtering out non-significant deviation points. If the current data point is larger than the upper band or lower than the lower band, it is compared to the previous data point. If the absolute difference of these two values is lower than the “Ignore Deviations Under” value, the property value is ignored.
Example: Upper band is 1,000 Mbps and lower band is 500 Mbps. The “Ignore Deviations Under” value is 5. The last data point is 999 and the current data point is 1003.
1003 (last data point) - 999 (current data point) = 4
4 < 5 (Ignore Deviations Under)
Therefore, the current data point of 1003 would not be considered as a deviant. Note that had there not been an “Ignore Deviations Under” value set, the 1003 data point would be a deviant since it is larger than the upper band.
In addition to the graph, the report output identifies the following.
- Number of Deviations
- Average Deviation Amplitude Absolute, which is the size difference between the highest and lowest property value s
- Average Deviation Amplitude Relative, which is a comparison of the absolute amplitude to the standard deviation
To configure reports for a specific network, select it from the Network list (top left). If there is only one network configured, the word “default” appears.
Example: Figure 10-2 shows an example of a report identifying two deviations. Figure 10-1 shows the configuration and an enlarged section of its output.
Figure 10-1 Deviation Report Configuration and Output
Figure 10-2 Example Deviation Report