Running Deviation Reports
Access: WAE Live > Analytics, click New Report, and select Deviation Report Type
Access: WAE Live > Explore, select objects, and click Run Report
The deviation report detects sudden changes in property values. While the report can be applied to any high-frequency property value, such as nodes’ CPUs, the primary use is to detect rapid increases and decreases in LSP or interface traffic. Determining the timestamp can assist you in correlating other network or service events that may have caused a reported surge.
This detection of a deviation is based on how traffic has behaved in the past, which is considered to be the norm or the moving average. For example, if traffic normally goes up and down within a specific band of Mbps, then this is normal traffic and would not be flagged as a deviation.
Deviation Report Parameters
The moving average and range of acceptable tolerance for the property value are determined by two configurable fields, each of which creates corresponding lines in the graph.
- Size of Historical Window —Identifies how many past data points to use in the calculation of the moving average.
– The moving average, which appears in the graph, is how WAE Live expects the property value to change based on past behavior. This is calculated using Bollinger Bands.
– A data point is a point in time in which you collect data. So, for example, if you collect every 5 minutes and you want the moving average to be based on the last 24 hours, you would enter 288.
- Sensitivity —Identifies the tolerance range (standard deviation), which is how far from the moving average the raw data can be before it is flagged as a deviance: the higher the number, the higher the tolerance. This creates two lines that are equal distance on either side of the moving average line. If raw data crosses either the upper or lower band of tolerance, a deviance is recorded. See Figure 10-1 for an example.
You can also set a threshold under which property values are not considered for the deviation calculation, thus filtering out non-significant deviation points. If the current data point is larger than the upper band or lower than the lower band, it is compared to the previous data point. If the absolute difference of these two values is lower than the “Ignore Deviations Under” value, the property value is ignored.
Example: Upper band is 1,000 Mbps and lower band is 500 Mbps. The “Ignore Deviations Under” value is 5. The last data point is 999 and the current data point is 1003.
1003 (last data point) - 999 (current data point) = 4
4 < 5 (Ignore Deviations Under)
Therefore, the current data point of 1003 would not be considered as a deviant. Note that had there not been an “Ignore Deviations Under” value set, the 1003 data point would be a deviant since it is larger than the upper band.
In addition to the graph, the report output identifies the following.
- Number of Deviations
- Average Deviation Amplitude Absolute, which is the size difference between the highest and lowest property value s
- Average Deviation Amplitude Relative, which is a comparison of the absolute amplitude to the standard deviation
To configure reports for a specific network, select it from the Network list (top left). If there is only one network configured, the word “default” appears.
Example: Figure 10-2 shows an example of a report identifying two deviations. Figure 10-1 shows the configuration and an enlarged section of its output.
Figure 10-1 Deviation Report Configuration and Output
Figure 10-2 Example Deviation Report
Tips for Viewing Graphed Deviations
- Increasing the “Ignore Deviations Under” value can make it easier to see the deviations.
- If the number of deviations reported in the table are different than what you see in the graph, use the zoom feature to see them. Zoom to a chosen timestamp, and note that timestamp. If you do not see the deviation of interest, zoom to a section of the graph immediately following that timestamp. Repeat this procedure, if needed, to see all of the deviations.
- If the tooltip for the deviation mark shows that the raw data is within the upper and lower boundaries (tolerance range), zoom into that deviation mark as many times as needed to see the raw data cross the boundary.
Deviation Report Tabs
Required Tabs
– Size of Historical Window —Enter the number of past data points (collections) to use in the calculation of the moving average.
– Sensitivity —Slide the scale to a number from 1 to 5 (including up to one decimal) to specify the tolerance range, which is how far from the moving average the raw data can be before it is flagged as a deviance.
– Ignore Deviations Under —(Optional) Enter a number (up to one decimal) to set the threshold under which property values are not considered for the deviation calculation.