Why Do Monitoring Service Thresholds Overlap?

Although the title of this blog poses the question “Why do Monitoring Service Thresholds Overlap?”, really the question should be: “In Remote Monitoring and Management Solutions, Why Do Some Monitoring Service Thresholds Overlap?”.  That’s a bit of a mouthful, but it’s what I’m going to look at in this blog. Here’s why overlapping thresholds in remote monitoring matter.

Understanding Remote Monitoring Thresholds

Remote monitoring involves the continuous observation and collection of data from sensors, devices, or systems, often in near real-time or at regular intervals. Thresholds are predefined limits or values that are set to monitor specific conditions. When the monitored data breaches these thresholds, it can trigger various actions such as sending alerts, initiating automated self-healing, or creating tickets in your PSA solution.

Not all remote monitoring thresholds will allow for overlapping thresholds, for example if the monitor is looking at a string value, it will either match the value or it won’t, in which case it will either be Normal or Failed.

Or in the case where the monitoring produces a status code, that value will dictate if it is in a Normal, Warning, or Failed state.

Overlapping thresholds occur when different thresholds share common ranges. While overlapping thresholds might seem counterintuitive, they serve a crucial purpose in remote monitoring.

Related Product

N‑sight RMM

Comece a operar rapidamente, contando com o RMM, projetado para MSPs e departamentos de TI de pequeno porte.

Find out more

The Purpose of Overlapping Thresholds

We know that when monitored data breaches its thresholds, it can trigger various actions such as sending alerts, initiating automated self-healing, or creating tickets in your PSA solution. For monitoring that looks at string values or status codes that would be perfectly fine, but what do you do if the data you are monitoring is more volatile, for example monitoring temperature status or memory usage. These types of monitoring can consistently fluctuate by very small amounts , and if the value they are fluctuating around are right on the threshold, this can lead to a whole load of notifications being sent or tickets being created. MSPs have enough issues to deal with on a daily basis without been notified of the same issue multiple times; and this is where overlapping thresholds come in. They reduce the noise that can be caused when the monitored data is flapping around a threshold.

Some examples of overlapping thresholds

Here are a couple of common examples, that will help you better understand the concept of overlapping thresholds:

Memory Monitoring on Servers: Monitoring memory on servers will alert when excessive memory usage is detected, which can slow down or crash server applications. In this example using overlapping thresholds we consider Physical Memory Usage (%) to be Normal between 0-85, Warning between 80-95, and Failed between 90-100.

As we can see the current Physical Memory Usage is 84% which is covered by both the Normal and Warning thresholds. So why is it showing as a Warning? As Physical Memory Usage on a server is monitoring data that is likely to fluctuate regularly, what’s happened here is at some stage the value has exceeded 85% changing the monitoring status from Normal to Warning, but in order for it to change back to Normal if must fall below 80%. If you didn’t use overlapping thresholds, and your setup was as Normal 0-80; Warning 81-90, then if the value was 80 that could mean it would be constantly jumping between Normal and Warning— generating a slew of alerts and notifications.

DISK – C: on Servers, Workstations, or Laptops: One of the most common items to monitor in any RMM solution is the C Drive, whether it is a server, workstation, or laptop. It is also very common for this monitoring service to have self-healing configured, in the form of disk clean up scripts run when thresholds are crossed.

Depending on how the script is configured, in some cases the clean-up script might not free up enough space to have the desired effect. In this case, by utilizing overlapping thresholds, you can ensure that enough space has been freed up before you return the monitoring status to Normal.

Related Product

N‑central

Manage large networks or scale IT operations with RMM made for growing service providers.

Find out more

Conclusion…

So, in conclusion, the concept of overlapping thresholds in remote monitoring and management solutions serves a vital purpose in ensuring the effectiveness and efficiency of monitoring systems. While it may initially seem counterintuitive to have thresholds that share common ranges, these overlapping thresholds play a crucial role in reducing unnecessary noise and preventing constant alerts and notifications. So, the next time you encounter overlapping thresholds in your monitoring setup, remember that they are there to optimize your monitoring experience and keep your IT environment running smoothly.

If you have questions on overlapping thresholds or anything else join me on the N-Central office hours at www.n-able.com/events.  For more insight on how you can get the most out of N‑central, you can attend our N‑central Boot Camps, recordings of which are available in N‑ableU which you can access via N‑ableMe, alternatively keep an eye on www.n-able.com/events to register for the live sessions.

Paul Kelly is the Head Nerd at N‑able. You can follow him on Twitter at @HeadNerdPaul, LinkedIn and Reddit at u/Paul _Kelly. Alternatively you can email me direct.