Anomaly Detection feature in PRTG

Hi frank Albert

I think I may have an idea how to achieve that. But only If you don't use the MAPview, because some sensor would be red.

Create a "user sessions" on the server (I assume you use terminalservers). Change the sensor in the notification tab to NOT send any notifications. Limit the sensor to upper limit 5 users. If 6 users are logged on it goes to red. Then create a bandwith sensor and give a upper limit 50mbps, as well "change dependency to use the "user sessions" as depended on. As long as not 6 or more users are logged on. It will measure the bandwith and if its more than 50mbit, the bandwith sensor goes to red (create a notification!) If more as 6 users are logged on, the "user session" sensor goes to red and the bandwith sensor will pause automatically (because the user session is red)

Do the same with another "user session" sensor but say it is red as long as fewer then 20users are logged on. (its red then) and create a dependency "bandwith sensor". As soon as you got more than 20 users, the bandwith sensor goes up, measures the bandwith. If its more than 150Mbps it will go to red, and trigger a notification.

It's quite a biiiiig hack, but maybe someone other has a better idea..

regards Thomas

Hello Thomas,

I appreciate the idea you gave, but is there is any possible plug-in or sensor that is dedicated for bandwidth anomaly detection....???

Regards Frank

I'm afraid there are no such 'plugins'. We do have the Unusual Detection in PRTG that tries to detect unusually low or high values on single sensors compared to the past values at the same time of day (week of day). You could look into using a Sensor Factory Sensor here. Simply calculate a 'factor' of your two values by dividing:

bandwidth / users

and then set Error/Warning limits if that factor reaches / exceeds a certain value.

Hello Torsten,

I am trying to configure the sensor factory sensor using this format :

1. 1:Sample Channel(1000,0)
2. 2:Response Time[ms] Channel(1001,1)

In sample 1 should I enter the id of my first sensor that is bandwidth sensor Channel(7685,0) What will be the value instead of 0...??? same I want to know for the the second channel...???