Is there a possibility to disable unusual detection for execution time of a sensor? I want to use this feature for alerting of any unusual activity but 99% of unusual states are caused by Execution Time which is completely irrelevant for this purpose - I need to alert on actual value retrieved like number of connections or some SQL results. I have tried to hide this channel on each sensor from graphs and tables but it still sets U state for these sensors.
Also I have searched google and this KB with no results.
Using 17.3.33.2830 from stable channel
Article Comments
Thank you for your answer, unfortunately it is not optimal as, for example, I need to get unusual status of SQL result but not on execution time of this query. Are there any changes planned for the future?
Sep, 2017 - Permalink
It was only available system wide for quite some time and was only changed rather recently to be disabled at a device level, so it may be available on a sensor level in the future, if enough people want it. In the meantime, the only way to remove an unusal state is to recreate the sensor.
Kind regards,
Stephan Linke, Tech Support Team
Sep, 2017 - Permalink
Hi Piotr,
The unusual detection can only be disabled on a device level, at the very bottom of its settings page.
Unticking the "Advanced Network Analysis" inheritance will reveal the option to disable it.
Kind regards,
Stephan Linke, Tech Support Team
Sep, 2017 - Permalink