The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Access: WAE Live > Analytics, click New Report, and select Deviation Report Type
Access: WAE Live > Explore, select objects, and click Run Report
The deviation report detects sudden changes in property values. While the report can be applied to any high-frequency property value, such as nodes’ CPUs, the primary use is to detect rapid increases and decreases in LSP or interface traffic. Determining the timestamp can assist you in correlating other network or service events that may have caused a reported surge.
This detection of a deviation is based on how traffic has behaved in the past, which is considered to be the norm or the moving average. For instance, if traffic normally goes up and down within a specific band of Mbps, then this is normal traffic and would not be flagged as a deviation.
The moving average and range of acceptable tolerance for the property value are determined by two configurable fields, each of which creates corresponding lines in the graph.
– The moving average, which appears in the graph, is how WAE Live expects the property value to change based on past behavior. This is calculated using Bollinger Bands.
– A data point is a point in time in which you collect data. So, for example, if you collect every 5 minutes and you want the moving average to be based on the last 24 hours, you would enter 288.
You can also set a threshold under which property values are not considered for the deviation calculation, thus filtering out non-significant deviation points. If the current data point is larger than the upper band or lower than the lower band, it is compared to the previous data point. If the absolute difference of these two values is lower than the “Ignore Deviations Under” value, the property value is ignored.
Example: Upper band is 1,000 Mbps and lower band is 500 Mbps. The “Ignore Deviations Under” value is 5. The last data point is 999 and the current data point is 1003.
1003 (last data point) - 999 (current data point) = 4
4 < 5 (Ignore Deviations Under)
Therefore, the current data point of 1003 would not be considered as a deviant. Note that had there not been an “Ignore Deviations Under” value set, the 1003 data point would be a deviant since it is larger than the upper band.
In addition to the graph, the report output identifies the following.
To configure reports for a specific network, select it from the Network list (top left). If there is only one network configured, the word “default” appears.
Example: Figure 10-2 shows an example of a report identifying two deviations. Figure 10-1 shows the configuration and an enlarged section of its output.
Figure 10-1 Deviation Report Configuration and Output
Figure 10-2 Example Deviation Report
– Size of Historical Window—Enter the number of past data points (collections) to use in the calculation of the moving average.
– Sensitivity—Slide the scale to a number from 1 to 5 (including up to one decimal) to specify the tolerance range, which is how far from the moving average the raw data can be before it is flagged as a deviance.
– Ignore Deviations Under—(Optional) Enter a number (up to one decimal) to set the threshold under which property values are not considered for the deviation calculation.
– Configuring Reports chapter
– Traffic Reports chapter
– Health Reports chapter
– Ad Hoc Reports chapter
– Reports chapter
– Report Log chapter