Band Factors and Dynamic Thresholds? Documentation?

Hi Lewis! 

I can't find the external facing documentation for you right now, but as I work with support to find the link, here is some information about band factors for dynamic thresholds:

Dynamic thresholds in LogicMonitor are determined by recent historical values of a metric, using an Exponentially Weighted Moving Average (EWMA) to compute the moving average that reflects the expected metric behavior over time. This moving average is crucial as it serves as a baseline for defining a confidence band—the range within which metric values are typically expected to fall. The confidence band is influenced by the band factor and is composed of:

• High Band Value: The upper limit of the confidence band.
• Middle Band Value: Represents the moving average or central trend of the metric.
• Low Band Value: The lower limit of the confidence band.

To establish dynamic thresholds, LogicMonitor multiplies the band factor by the standard deviation of the EWMA. This band factor adjusts the width of the confidence band, controlling how sensitive the system is to deviations from the average.

Math Behind the Upper and Lower Thresholds

Dynamic thresholds are formulated as follows:

• Calculated upper threshold = High band value + ((High band value - Middle band value) * Band factor value)
• Calculated lower threshold = Low band value - ((Low band value - Middle band value) * Band factor value)

Example

Consider a scenario where a dynamic threshold alert is triggered at a metric value of 875 and cleared at a value of 911. During this time:

• The low band value was 1140.8189904414764,
• The high band value was 1617.0042995940594,
• The middle band value was 1154.810037595492,
• And the band factor value was 3.5.

The above low, high, and middle values were obtained from Prod3la logs, which will be explained in the next section.

Using the upper and lower threshold calculation formulas, we find the calculated/fixed normal range:

• Calculated upper threshold = 1617.0042995940594 + ((1617.0042995940594 - 1154.810037595492) * 3.5) = 3234.684216589045
• Calculated lower threshold = 1140.8189904414764 - ((1140.8189904414764 - 1154.810037595492) * 3.5) = 1189.7876554805312

In the above scenario, the alert triggers when the metric value falls below the calculated lower threshold of 1189.7876554805312. The alert was cleared when the metric value rose back towards this threshold indicating that the performance of the system was returning to normal operational ranges.

We also have a best practices blog on dynamic thresholds you can use as another resource. I hope this helps!