Calculation time
To estimate the time that is required to complete the calculation for the above data set of 500,000 calculations:
- By default, the number of threads that are used to complete the
calculation is
4.- With 4 threads in use, the time that is required for each calculation is approximately 1 millisecond.
- With 1 thread in use, the time that is required for each calculation is approximately 4 milliseconds.
- For more information about configuring the number of threads, see Performance.
- So, calculation for the Anomaly Detections in this environment requires approximately 500 seconds, which is 8 minutes 20 seconds.
Resource utilization goals
Note: If you auto-create hourly Anomaly Detections for 1000 events and 500 whitelisted values, the estimated calculation time using 4 calculation threads is 8 minutes 20 seconds. These calculations are performed each hour, which means that 1/6 of the Data Collector's time is spent computing hourly Anomaly Detections. This impact may become an issue for Data Collector to complete its other tasks.
- See Performance.
For hourly Anomaly Detections, the goal is to reduce calculation time to less than 5 minutes. You must balance the number of events x the number of whitelisted dimensions against the number of threads that are used during calculation and the general CPU load at the time of calculation.
- By default, daily Anomaly Detections are scheduled to be recalculated at 4:30 in the morning. You can schedule them to occur at any time. See Scheduling.