static double SetClasses(char *name, double variable, double av_expect, double av_var, double localav_expect,
double localav_var, Item **classlist, char *timekey)
{
char buffer[CF_BUFSIZE], buffer2[CF_BUFSIZE];
double dev, delta, sigma, ldelta, lsigma, sig;
delta = variable - av_expect;
sigma = sqrt(av_var);
ldelta = variable - localav_expect;
lsigma = sqrt(localav_var);
sig = sqrt(sigma * sigma + lsigma * lsigma);
Log(LOG_LEVEL_DEBUG, "delta = %lf, sigma = %lf, lsigma = %lf, sig = %lf", delta, sigma, lsigma, sig);
if ((sigma == 0.0) || (lsigma == 0.0))
{
Log(LOG_LEVEL_DEBUG, "No sigma variation .. can't measure class");
snprintf(buffer, CF_MAXVARSIZE, "entropy_%s.*", name);
MonEntropyPurgeUnused(buffer);
return sig;
}
Log(LOG_LEVEL_DEBUG, "Setting classes for '%s'...", name);
if (fabs(delta) < cf_noise_threshold) /* Arbitrary limits on sensitivity */
{
Log(LOG_LEVEL_DEBUG, "Sensitivity too high");
buffer[0] = '\0';
strcpy(buffer, name);
if ((delta > 0) && (ldelta > 0))
{
strcat(buffer, "_high");
}
else if ((delta < 0) && (ldelta < 0))
{
strcat(buffer, "_low");
}
else
{
strcat(buffer, "_normal");
}
AppendItem(classlist, buffer, "0");
dev = sqrt(delta * delta / (1.0 + sigma * sigma) + ldelta * ldelta / (1.0 + lsigma * lsigma));
if (dev > 2.0 * sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_microanomaly");
AppendItem(classlist, buffer2, "2");
EvalContextHeapPersistentSave(buffer2, "measurements", CF_PERSISTENCE, CONTEXT_STATE_POLICY_PRESERVE);
}
return sig; /* Granularity makes this silly */
}
else
{
buffer[0] = '\0';
strcpy(buffer, name);
if ((delta > 0) && (ldelta > 0))
{
strcat(buffer, "_high");
}
else if ((delta < 0) && (ldelta < 0))
{
strcat(buffer, "_low");
}
else
{
strcat(buffer, "_normal");
}
dev = sqrt(delta * delta / (1.0 + sigma * sigma) + ldelta * ldelta / (1.0 + lsigma * lsigma));
if (dev <= sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_normal");
AppendItem(classlist, buffer2, "0");
}
else
{
strcpy(buffer2, buffer);
strcat(buffer2, "_dev1");
AppendItem(classlist, buffer2, "0");
}
/* Now use persistent classes so that serious anomalies last for about
2 autocorrelation lengths, so that they can be cross correlated and
seen by normally scheduled cfagent processes ... */
if (dev > 2.0 * sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_dev2");
AppendItem(classlist, buffer2, "2");
EvalContextHeapPersistentSave(buffer2, "measurements", CF_PERSISTENCE, CONTEXT_STATE_POLICY_PRESERVE);
}
if (dev > 3.0 * sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_anomaly");
AppendItem(classlist, buffer2, "3");
EvalContextHeapPersistentSave(buffer2, "measurements", CF_PERSISTENCE, CONTEXT_STATE_POLICY_PRESERVE);
}
return sig;
}
}
static double SetClasses(char *name, double variable, double av_expect, double av_var, double localav_expect,
double localav_var, Item **classlist, char *timekey)
{
char buffer[CF_BUFSIZE], buffer2[CF_BUFSIZE];
double dev, delta, sigma, ldelta, lsigma, sig;
CfDebug("\n SetClasses(%s,X=%lf,avX=%lf,varX=%lf,lavX=%lf,lvarX=%lf,%s)\n", name, variable, av_expect, av_var,
localav_expect, localav_var, timekey);
delta = variable - av_expect;
sigma = sqrt(av_var);
ldelta = variable - localav_expect;
lsigma = sqrt(localav_var);
sig = sqrt(sigma * sigma + lsigma * lsigma);
CfDebug(" delta = %lf,sigma = %lf, lsigma = %lf, sig = %lf\n", delta, sigma, lsigma, sig);
if (sigma == 0.0 || lsigma == 0.0)
{
CfDebug(" No sigma variation .. can't measure class\n");
snprintf(buffer, CF_MAXVARSIZE, "entropy_%s.*", name);
MonEntropyPurgeUnused(buffer);
return sig;
}
CfDebug("Setting classes for %s...\n", name);
if (fabs(delta) < cf_noise_threshold) /* Arbitrary limits on sensitivity */
{
CfDebug(" Sensitivity too high ..\n");
buffer[0] = '\0';
strcpy(buffer, name);
if ((delta > 0) && (ldelta > 0))
{
strcat(buffer, "_high");
}
else if ((delta < 0) && (ldelta < 0))
{
strcat(buffer, "_low");
}
else
{
strcat(buffer, "_normal");
}
AppendItem(classlist, buffer, "0");
dev = sqrt(delta * delta / (1.0 + sigma * sigma) + ldelta * ldelta / (1.0 + lsigma * lsigma));
if (dev > 2.0 * sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_microanomaly");
AppendItem(classlist, buffer2, "2");
NewPersistentContext(buffer2, CF_PERSISTENCE, cfpreserve);
}
return sig; /* Granularity makes this silly */
}
else
{
buffer[0] = '\0';
strcpy(buffer, name);
if ((delta > 0) && (ldelta > 0))
{
strcat(buffer, "_high");
}
else if ((delta < 0) && (ldelta < 0))
{
strcat(buffer, "_low");
}
else
{
strcat(buffer, "_normal");
}
dev = sqrt(delta * delta / (1.0 + sigma * sigma) + ldelta * ldelta / (1.0 + lsigma * lsigma));
if (dev <= sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_normal");
AppendItem(classlist, buffer2, "0");
}
else
{
strcpy(buffer2, buffer);
strcat(buffer2, "_dev1");
AppendItem(classlist, buffer2, "0");
}
/* Now use persistent classes so that serious anomalies last for about
2 autocorrelation lengths, so that they can be cross correlated and
seen by normally scheduled cfagent processes ... */
if (dev > 2.0 * sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_dev2");
AppendItem(classlist, buffer2, "2");
NewPersistentContext(buffer2, CF_PERSISTENCE, cfpreserve);
}
if (dev > 3.0 * sqrt(2.0))
{
strcpy(buffer2, buffer);
strcat(buffer2, "_anomaly");
AppendItem(classlist, buffer2, "3");
NewPersistentContext(buffer2, CF_PERSISTENCE, cfpreserve);
}
return sig;
}
}
