Baselines & N-sigma

Fixed thresholds rarely fit every hour: 60 % CPU is normal on Monday morning but suspicious at 3 a.m. on Sunday. Baselines solve this by learning each server's normal behaviour.

How the baseline is built

The monitor computes a rolling average and standard deviation per day-of-week × hour-of-day. Every metric gets an expected band that reflects the real daily and weekly rhythm.

N-sigma deviation

An alert can be based on an N-sigma deviation instead of a fixed value: it fires when the current reading is more than N standard deviations away from the baseline average for that time window.

• Small N (e.g. 2) → more sensitive, more alerts.
• Large N (e.g. 4) → only pronounced outliers.

Example: if CPU on Sunday night is typically 10 % ± 5 %, a value of 40 % trips at N = 3 – even though 40 % as a fixed threshold would never have stood out.

Working with hysteresis

N-sigma alerts use the same hysteresis and silences as fixed rules, so they behave just as quietly.

Baselines need some history to be meaningful. Right after adding a server the band is still wide; it tightens as the days go by.