Q. I need to create an alarm based on the running average of probe values. How do I go about doing this?
A. There are two steps to accomplish this:
1) A weighted or running average is computed by adding a fraction of the new value to the "previous" value. This means that the current value(s) will contribute a portion to what is remembered: if the current values are lower than the running average, it'll tend to drag the running average down; if the current values are higher, the running average will trend higher...
In normal arithmetic, the way to compute this would be:
new_average = 0.1 * current_value + 0.9 * previous_average
NB: the 0.1 and 0.9 are constants that you could change. Setting them to 0.25 and 0.75 will cause the running average to move more quickly to follow the change in the current values; setting them to 0.05 and 0.95 cause the running average to move more slowly.
2) So here's how you do it in InterMapper. Custom probes have a way of remembering the "previous" value, so that it can be used in the calculation above. To do this:
|curvalue, 188.8.131.52.x.x.x.x, INTEGER, "Current Value"
newaverage, 0.1*$curvalue + 0.9*$prevaverage, CALCULATION, "current running average"
prevaverage, $newaverage, CALCULATION, "becomes the previous"