Hi,
I would like to understand the logic of the Unusual Sensor, but currently the information in the help is not enough.
What does the options exacltly mean? Can you write in noob style?
And: 24h average is <80% or >120% of weekday average
Does it mean, between 80% and 120%? If so, it should be written like:
24h average is >80% or <120% of weekday average
Kind Regards,
Bastiaan
Article Comments
Hi Bastiaan,
The "unusual" status of a sensor means that the currently measured values of the sensor show big differences to the values that are normally retrieved by this sensor. So, for example, if your traffic sensor on a router suddenly shows a huge increase in traffic compared to other days (which might hint on an attack from the outside), PRTG can recognize this and indicates it with the "unusual" status of the sensor.
PRTG calculates the comparison between current and historic monitoring data on a 24 hour basis with internal heuristic methods. See also this article. Please understand that we cannot be more specific on this mathematical approach.
The option "24h average is <80% or >120% of weekday average" means that the current 24 hour average of this sensor is either lower than 80% or higher than 120% than the usually measured values of this sensor.
Consider a traffic sensor that usually measures 100 MB average traffic on a weekday. If you choose this option, it would show an unusual status if the current average is below 80 MB or above 120 MB. So the available options for "Unusual Detection" define the granularity of this sensor status.
Jun, 2015 - Permalink
Thank you very much, this explains it very well ! Please add it to the help :-)
Jun, 2015 - Permalink
Hello! This status only apply to metric sensors? I mean only for Traffic or Time measured (like Ping Response time)? Or status Unusual can appear in any Sensor even if sensor has only ON or OFF status (for ex. VPN status Active or Down)? Or any sensors in PRTG IS metric?
Sep, 2018 - Permalink
Hi there,
The unusual engine is meant for all sensors that hold values. But such lookup sensors/channels are more or less ignored as a difference of 100% or even 200% is easily reached when the value changes from 1 to 2 or 3.
Best regards.
Sep, 2018 - Permalink
Hi Bastiaan,
The "unusual" status of a sensor means that the currently measured values of the sensor show big differences to the values that are normally retrieved by this sensor. So, for example, if your traffic sensor on a router suddenly shows a huge increase in traffic compared to other days (which might hint on an attack from the outside), PRTG can recognize this and indicates it with the "unusual" status of the sensor.
PRTG calculates the comparison between current and historic monitoring data on a 24 hour basis with internal heuristic methods. See also this article. Please understand that we cannot be more specific on this mathematical approach.
The option "24h average is <80% or >120% of weekday average" means that the current 24 hour average of this sensor is either lower than 80% or higher than 120% than the usually measured values of this sensor.
Consider a traffic sensor that usually measures 100 MB average traffic on a weekday. If you choose this option, it would show an unusual status if the current average is below 80 MB or above 120 MB. So the available options for "Unusual Detection" define the granularity of this sensor status.
Jun, 2015 - Permalink