Ski Session: AIOps Adoption Recap
Summary: The Ski School session on AIOps Adoption featured an interactive and insightful overview on employing AI-driven capabilities for enhanced monitoring and alerting. Led by the LogicMonitor community and product teams, practitioners explored techniques for effective noise reduction, accelerated troubleshooting, and optimized alert triage using AIOps. A highlight was the discussion on dynamic thresholds, including their implementation, benefits, and limitations, as well as best practices. Several questions were addressed regarding the application of both dynamic and static thresholds, configurations, and integration with cloud services. The session concluded with a preview of upcoming Ski School topics focused on Resource Management, Alerts, and the Edwin AI badge session.
Overview
Ski School officially kicked off with Week 1’s focus on AIOps Adoption, bringing together practitioners from across the globe for an interactive, question-driven session led by LogicMonitor’s community, training, and product teams. The group dug into practical ways to use AI-driven capabilities to reduce noise, accelerate troubleshooting, and tighten alerting without losing visibility. The throughline was clear: when you pair strong monitoring fundamentals with the right AIOps features, you get faster signal, better context, and fewer “guess-and-check” investigations.
Key Highlights
AI for Logs, minus the haystack problem: A walkthrough of log anomalies (surfacing “never seen before” events) and log analysis to filter and isolate meaningful patterns from high-volume logs.
Alert triage with datapoint correlation: A demo of Datapoint Analysis to identify metrics that correlate strongly with an alert and help trace causal relationships across resources.
Dynamic Thresholds, deep dive: The most-discussed topic of the session. The group covered how dynamic thresholds learn “normal,” how to tune band factors, and where static thresholds still make sense.
Q&A
Q: Can you implement Boolean thresholds? For example, value is outside the band AND above X?
A: Not that I’m aware of today. That sounds great, and I’m making a note of that now. No, we do not have a way to combine those together.
Q: Can we run Dynamic and Static thresholds together?
A: Yes, you can. We recommend doing that at the beginning so that you are still getting the alerts you expect to get. As the dynamic threshold continues to learn and establish a baseline, once you are comfortable, you can turn off the static threshold.
Q: Are dynamic thresholds tighter for Tier-0 sites and looser for Tier-2/Tier-3 sites?
A: Not that I’m aware of. It is one algorithm that dynamically learns based on the patterns.
Q: It has been a month since we implemented dynamic thresholds for network bandwidth utilization, yet we are still experiencing some false-positive alerts. How long does the system typically require to fully learn and adapt to the traffic patterns?
A: It usually takes about a week, and it is constantly adjusting. If you are still seeing false positives about a month in, it is best to open a support case so the support and engineering teams can investigate whether it is a configuration issue, a datapoint collection issue, or a known issue with a device type or data source.
Q: We have a VM with memory utilization normally around 95. When trying to set dynamic thresholds, the high confidence level is around 105, which is greater than 100. Is dynamic threshold a good use case here?
A: Maybe not. A good follow-up question is what the low threshold looks like, or what you are seeing as the normal lower benchmark for that VM. You may want to set a static threshold, but if the low threshold fluctuates, you can apply dynamic thresholding to focus on the lower portion while tightening the upper band so it does not exceed 100.
Q: Do you recommend going with dynamic thresholds for this datapoint: InUtilization/OutUtilization Bandwidth?
A: Yes. Bandwidth is a good use case because it fluctuates a lot, and dynamic thresholds can learn the normal range. If an interface has been at a level like 25% for a long period, that may be normal behavior, and a dynamic threshold is well suited for learning expected throughput for that interface.
Q: Is it mandatory to have all device types available in the environment in order to leverage AIOps and be fully operational?
A: It depends on your use case. To take full advantage of what was shown, you would need to be monitoring the device in LogicMonitor, and you would also need to be sending logs from those devices. If you are only monitoring the device but not ingesting logs, you will not be able to use the log capabilities that were demonstrated.
Q: I need to ingest alerts from AWS, Azure, and GCP into Edwin AI using a direct event integration approach. How would you recommend I monitor for issues with the integration?
A: There is not currently a way to monitor event-ingestion problems via the UI. If the platform rejects a payload, logs can be pulled to understand why. If the issue is on your side, such as where the SDK is hosted, the recommended approach is to monitor that hosting environment (for example, the container running the SDK) to determine whether the problem is occurring on your end or whether payloads are being rejected on the LogicMonitor side.
Q: Is it possible to do any kind of alerting on “View Forecast”?
A: View Forecast works side-by-side with dynamic thresholds and provides a projection of where dynamic thresholds think the expected range will adjust. Alerting is done on the dynamic threshold itself, not on the View Forecast view.
Q: Is there a list of the top ten common data sources where dynamic thresholds are recommended?
A: There is no official list. The team said they can dig into what customers are using and work on sharing guidance in the community on which data sources are a good fit.
Q: Can dynamic thresholds work on a time basis?
A: Unfortunately, time-based seasonality is not supported right now.
Q: Do we need Edwin AI for dynamic thresholds?
A: Dynamic thresholds are part of the base platform, so they should be available in your portals today.
Q: Are there any plans for a LogicMonitor MCP server?
A: It is actively being discussed, and there are plans for it. What will be allowed and what the limitations will be are not yet known, but it is something the team is working on.
Q: Any plans for a dark mode?
A: There are underlying UI components being upgraded. Once those are updated, dark mode may be possible, but nothing is promised.
What’s Next
Next up, the Ski Sessions continue with Resource Management, then Alerts, and wrap with the newest Edwin AI badge session. Expect more hands-on demos and plenty of time for live Q&A with LogicMonitor experts.
Register for Resource Management Ski Session
Register for Alerts Ski Session
Register for Edwin AI Ski Session
Additional Resources
Best Practices For Practitioners: Dynamic Thresholds
Dynamic Thresholds for Datapoints
Dynamic Thresholds discussions (LogicMonitor Community)
Want to review the session? Watch the recording directly from the event page!
