cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Aggregation: Max

suraj_kumar_gup
Inactive

Hi,

what does aggregation "max" denotes? I see we have one incident created for garbage collection and we used "Evaluation timeframe = 10Mins" and "aggregation = Max" and threshold is 10s.

If the garbage collection is crossed 10 seconds in the interval of 10 mins would generate the alert?

Now I am little confused about how to explain this incident to others.

Regards,

Suraj Gupta

5 REPLIES 5

Mike_L
Dynatrace Pro
Dynatrace Pro

Hi Suraj,

If there is one or more garbage collections of the selected type, PS Mark Sweep (major), that takes 10 seconds or more the incident is triggered. Once there haven't been any slow garbage collection for 10 minutes the incident is closed.

Hi Michael,

Thanks for replying, what i understand from your comment is it will check every 10minutes and if the GC crossed 10s then it will trigger and if it comes down or no spike of 10seconds or more in the next 10minutes cycle then it will close.

can you please explain if we use Last instead of Max then how this incident work?

Regards,

Suraj Gupta

Hi Suraj,

It will check every 10 seconds if the GC crossed it during the previous 10 minutes.

If you change it to Last then it is the latest garbage collection that needs to take 10 seconds or more. As soon as there is a more recent garbage collection that takes less than 10 seconds, or if there is no garbage collection during the previous 10 minutes, the incident is closed.

Mike

peter_karlhuber
Dynatrace Pro
Dynatrace Pro

Hi Suraj,

there's 3 moving parts that determine when and for how long an incident is active (i.e. has fired).

1. The evaluation timeframe is a moving window that goes from now into the past for the specified amount of time (10 mins in your case)

2. The measure that is configured to trigger the incident has a threshold set that needs to be exceeded or underflown (or flowed or whatever)

3. The aggregation on the incident specifies how all the measurements that the measure has collected in the evaluation time frame are combined before being compared to the threshold.

In your case, the maximum of all the values that the measure collected during the last 10 minutes will be compared to 10 seconds. Best regards,

Peter

Edit: removed wrong assumption

andreas_grabner
Dynatrace Leader
Dynatrace Leader

Additionally to what has already been explained: In this video I explain how Incidents work, how Measure Conditions are evaluated and how the Evaluation Timeframe plays out. Hope this also helps understanding the internals of Dynatrace Incident Management: https://www.youtube.com/watch?v=Ysh_HL8HDoA&t=735s&index=11&list=PLqt2rd0eew1bmDn54E2_M2uvbhm_WxY_6