How does the High Memory Usage detection behave with Page Fault thresholds?

[Sohel_Rashid]

Hi Dynatrace community Team,

I would like to understand the expected behavior of the High Memory Usage on Host detection when using custom page fault thresholds.

Currently, we have configured:

• Memory usage threshold: 80%
• Windows page fault threshold: 100 faults/sec
• Linux/Unix page fault threshold: 20 faults/sec
• Detection mode: Based on custom settings

The configuration states that an alert is generated when both memory usage and memory page fault rate thresholds are exceeded.

Specifically, I would like to understand whether both conditions must be continuously exceeded for the defined number of samples before Dynatrace generates the problem.

Also, could you please clarify how the “defined amount of samples” is evaluated for the page fault rate?

Thanks in advance for your clarification.

[p_devulapalli]

@Sohel_Rashid Yes, both the conditions needs to be met for the defined samples/duration to alert

https://docs.dynatrace.com/docs/shortlink/event-types-resource#memory-saturation

• Windows: By default, Dynatrace alerts if memory usage is higher than 90% and the memory page fault rate is higher than 100 faults/s within 18 of 30 10-second intervals.

• Linux: By default, Dynatrace alerts if memory usage is higher than 80% and the memory page fault rate is higher than 20 faults/s within 18 of 30 10-second intervals.

[sujit_k_singh]

Hi @Sohel_Rashid 

In addition to the @p_devulapalli , I am adding more insight of how the High Memory Usage on Host detection works with your custom configuration:

With your configuration (memory ≥ 80% AND page faults ≥ 100/sec for Windows or ≥ 20/sec for Linux/Unix), Dynatrace uses a dual-condition AND gate:

Both the memory usage threshold and the page fault rate threshold must be exceeded simultaneously for a sample to count as a "violating sample."
If only one condition is met (e.g., memory is above 80% but page faults are below the threshold), that sample does not count as a violation.

How the "Defined Amount of Samples" is evaluated
Dynatrace uses a sliding window model for evaluation. The key parameters are:

slidingWindow  - 5 samples
violatingSamples - 3 samples
dealertingSamples - 5 samples

So with defaults, Dynatrace looks at the last 5 minutes of data. If 3 or more of those 1-minute samples show both memory usage above 80% and page fault rate above your threshold, a problem is raised.

Page Fault Rate Evaluation Specifics
The page fault rate is sampled at the same 1-minute interval as memory usage. Each 1-minute sample is evaluated against your configured threshold (100/sec for Windows, 20/sec for Linux/Unix). The value used per sample is typically the average page fault rate observed during that minute.

Thanks,

Sujit