What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags

View all Tags

Anomaly Detection feature in PRTG



Hello Experts,

I am trying to implement anomaly detection using prtg. What I am trying to do is I have two sensors one is for bandwidth and the other one is for users(fetching user count using WMI sensor) Now I want to compare these two sensor's values like if the the user count is 20 and the last value in the bandwidth sensor is 150Mbps then the alert is not generated but if the user count is 5 and the last value in the bandwidth sensor is 50Mbps then a alert is generated. The alert depends upon the number of users and bandwidth.


bandwidth-monitor bandwidthsensor wmi wmi-custom-sensor

Created on Aug 27, 2015 7:43:53 AM

4 Replies



Hi frank Albert

I think I may have an idea how to achieve that. But only If you don't use the MAPview, because some sensor would be red.

Create a "user sessions" on the server (I assume you use terminalservers). Change the sensor in the notification tab to NOT send any notifications. Limit the sensor to upper limit 5 users. If 6 users are logged on it goes to red. Then create a bandwith sensor and give a upper limit 50mbps, as well "change dependency to use the "user sessions" as depended on. As long as not 6 or more users are logged on. It will measure the bandwith and if its more than 50mbit, the bandwith sensor goes to red (create a notification!) If more as 6 users are logged on, the "user session" sensor goes to red and the bandwith sensor will pause automatically (because the user session is red)

Do the same with another "user session" sensor but say it is red as long as fewer then 20users are logged on. (its red then) and create a dependency "bandwith sensor". As soon as you got more than 20 users, the bandwith sensor goes up, measures the bandwith. If its more than 150Mbps it will go to red, and trigger a notification.

It's quite a biiiiig hack, but maybe someone other has a better idea..

regards Thomas

Created on Aug 27, 2015 2:08:34 PM



Hello Thomas,

I appreciate the idea you gave, but is there is any possible plug-in or sensor that is dedicated for bandwidth anomaly detection....???

Regards Frank

Created on Aug 28, 2015 7:43:31 AM



I'm afraid there are no such 'plugins'. We do have the Unusual Detection in PRTG that tries to detect unusually low or high values on single sensors compared to the past values at the same time of day (week of day). You could look into using a Sensor Factory Sensor here. Simply calculate a 'factor' of your two values by dividing:

bandwidth / users

and then set Error/Warning limits if that factor reaches / exceeds a certain value.

Created on Aug 28, 2015 11:34:33 AM by  Torsten Lindner [Paessler Support]



Hello Torsten,

I am trying to configure the sensor factory sensor using this format :

  1. 1:Sample Channel(1000,0)
  2. 2:Response Time[ms] Channel(1001,1)

In sample 1 should I enter the id of my first sensor that is bandwidth sensor Channel(7685,0) What will be the value instead of 0...??? same I want to know for the the second channel...???

Created on Aug 29, 2015 8:58:09 AM

Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.