I have introduced the EV meta-metric in 2001 as a measure of anomaly severity. EV stands for Exception Value and more explanation about that idea could be found here: The Exception Value Concept to Measure Magnitude of Systems Behavior Anomalies
Basically it is the difference (integral) between actual data and control limits. So far I have used EV data mostly to filter out real issues or for automatic hidden trend recognition. For instance, in my paper CMG’08 “Exception Based Modeling and Forecasting” I have plotted that metric using Excel to explain how it could be used for a new trend starting point recognition. Here is the picture from that paper where EV called “Extra Volume” and for the particular parent metric (CPU util.) it is named ExtraCPUtime:
|The EV meta-metric first chart|
But just plotting that meta-metric and/or two their components (EV+ and EV-) over time gives a valuable picture of system behavior. If system is stable that chart should be boring showing near zero value all the time. So using that chart would be very easy (I believe even easier than in MASF Control Charts) to recognize unusual and statistically significant increase or decrease in actual data in very early stage (Early Warning!).
Here is the example of that EV-chart against the same sample data used in few previous posts:
1. Excel example:
2. BIRT/MySQL example as a continuation of the exercise from the previous post:
|IT-Control chart vs. EV-Chart|
Here is the BIRT screenshots that illustrate how that is built:
a. A. Addition query to get EV calculated written directly in the additional BIRT Data Set object called “Data set for EV Chart”:
|SQL query to calculate EV metric from the data kept in MySQL table|
B. Then additional bar-chart object is added to the report that is bind to that new “Data set for EV Chart”:
Result report is already shown here.