What are the requirements in TrueSight Infrastructure Management for Baselines to be calculated on Attributes?

Baselines are not generated for all Attributes within TrueSight Infrastructure Management.  There are conditions in two areas that must be met for Baselines to be calculated for an Attribute - Abnormality Thresholds and Attribute KPI settings.

Abnormality Threshold Requirement

First, an active/enabled Abnormality Threshold (Global or Instance) must be set on the Attribute.  Abnormality Thresholds are not automatically set for all Attributes, they are only set automatically (out of the box) for KPI Attributes.  In addition, the Abnormality Threshold cannot be suppressed.

A Global Abnormality Threshold can be viewed or set in the TrueSight Presentation Server Console, under Configuration->Global Thresholds, and switching to the 'Advanced' view.  An Instance level Abnormality Threshold would be set through an Infrastructure Policy.

Note:  Absolute thresholds (with "outside baseline") or signature thresholds does not satisfy this  requirement.  

KPI Attribute Requirement

The second requirement with the default configuration is that the Attribute must be set as a Key Performance Indicator (KPI) Attribute.  Normally, an Attribute is set to be KPI or not based upon the settings of the relevant PATROL KM itself.  However, a user can choose to enable additional Attributes to be Key Performance Indicators in the Admin Console (Java client) of the TrueSight Infrastructure Management Server (TSIM).  In the Admin Console, navigate to Tools->'KPI Administration' to do this.

As stated, this is the default configuration with the TSIM, and the configuration that most users stay with.  However, this requirements can be altered, at the expense of Performance and Memory usage with the Rate process on the TSIM Server.  In the TSIM User Console (web console), you can navigate to Options->Administration->'Intelligent Event Reduction', and tick the box for 'Enable Abnormality Detection and Baseline Generation for non-KPI metrics'.  Checking this box enables baseline generation for non-KPI metrics.  Unchecking this box (default configuration) prevents baseline generation for non-KPI metrics.

That page in the User Console does give the warning of 'Enabling abnormality detection and baseline generation for non-KPI metrics will increase memory requirements for the 'rate' process significantly (3X or 4X) on large deployments. Before enabling this option, please ensure the MaxHeap for 'rate' process is sufficiently high and the server has additional free memory to handle the increased processing load.', and BMC does not recommend enabling this option.

For historical information, this setting of enabling baseline generation for non-KPI metrics was enabled by default in the ProactiveNet 7.7 release and prior.  Since the ProactiveNet 8.0 release (thus, all BMC ProactiveNet Performance Management/BPPM and TrueSight Infrastructure Management releases), it has not been enabled by default.

Both of the above requirements must be met on an Attribute for a baseline to be generated.  This means that a baseline will not be generated for an Attribute that does have an Abnormality Threshold set, but is not set as a KPI Attribute (or the above option for enabling Baselines for non-KPI attributes is not set).  Likewise, a baseline will not be generated for a KPI Attribute, if the Abnormality Threshold for it is disabled/suppressed.

With the above requirements met, Baselines can be generated for these Attributes, once data collection is happening for them, as this is what Baseline generation is about - learning the normal range of behavior of Attributes in a particular environment.

Additional FAQ

Can I disable Abnormality Thresholds, and still use Signature Thresholds on an Attribute?
   No, this cannot be done.  Signature Thresholds use Baselines.  Since Abnormality Thresholds are a requirement of Baseline generation, a Signature threshold would not be possible without them.

When I set the Signature threshold with Auto baseline, how long does it take to obtain the baseline?  Could this be why it did not generate an alarm - it didn't have a baseline?
    It takes 24 hours from the time the monitor instance was added to get the first approximation of Baselines.  As per the above question, Signature Thresholds cannot be evaluated until the Baseline becomes
    available for that Attribute.

When I use an Hourly Baseline with a Threshold, how long does it take to get the Baseline before it will generate alarms?
    It takes 24 hours to get the initial Baseline for a monitor instance, assuming that all of the requirements are met.  After that, it depends on whether Absolute or Signature Threshold is used.  In general, Absolute Thresholds can generate alarms immediately (assuming that duration is '0').  Signature thresholds need more time -  a minimum of 15 minutes for out of the box settings.
 
Just to verify how the sampling works: Using a threshold based on sampling intervals/consecutive of true samples such as CPU Utilization over 90% with a 5 minute sampling interval and 5 true data points.   This will be a total of 25 minutes before an Alarm is generated?  Does it get a data points every 5 minutes for 25 minutes and has to stay above 90% each sampling, or it will reset?
    Assuming this is referring to Signature Thresholds here: 
    Signature Thresholds do not require that all data points exceed the Baseline/Threshold, just 'enough' of them.   A Signature Threshold requires a minimum of 3 data points, and with a default polling interval of 5 minutes, it will take 15 minutes to generate alarm.  Once that Alarm is generated, it stays open as long as 'enough' data points stay above the Baseline/Threshold.

Further Information:
  Please watch the 'Moving Beyond Dynamic Baselines: Abnormality & Event Definition' Webinar at https://community.bmc.com/s/news/aA33n000000CmOPCA0/recording-moving-beyond-dynamic-baselines