Avior goals

Avior™, the SolarWinds AI agent, provides agentic automation and decision support across the SolarWinds Observability platform. This guide summarizes Avior operational goals and highlights the primary metrics used to measure progress for each goal.

Optimize Alert Thresholds

Optimize Alert Thresholds is designed to identify and correct miscalibrated numeric thresholds or evaluation policies. It targets alerts that flap at the boundary, fire constantly against a low baseline, or clear immediately because no reset hysteresis exists, and it requires threshold changes to be grounded in observed metric data with explicit benefit and risk framing.

Related metrics

• flapping_alert_count tracks enabled alert configurations with more than 4 trigger events and more than 3 clear events in the last 24 hours, showing where threshold tuning should first reduce oscillation.
• constant_noise_alert_count measures enabled alert configurations with more than 50 trigger events in the last 30 days and serves as a proxy for severe miscalibration or chronic oversensitivity.
• threshold_candidate_count counts enabled alert configurations whose cumulative TriggeredCount is above 50, helping identify high-volume candidates for data-backed threshold review.

Reduce Alert Flapping

Reduce Alert Flapping is focused on identifying alert configurations that oscillate between triggered and cleared states faster than the underlying signal has real operational meaning. The goal is to isolate the main cause of churn, such as a missing sustain window, weak reset logic, no hysteresis gap, or upstream dependency churn, and then apply the narrowest safe fix until flapping measurably declines across the environment.

Related metrics

• Flapping Configs (24h) counts enabled alert configurations with more than 4 trigger events and more than 3 reset events in the last 24 hours, making it the primary indicator of active churn.
• Churn Ratio (24h) measures the fraction of alert history events in the last 24 hours that are resets, helping quantify oscillation load on the environment.
• Active Alerts tracks the total number of active alert instances and should fall as flapping configurations are tuned and stop reopening unnecessarily.

Reduce Alert Noise

Reduce Alert Noise is the broadest alert-health goal. It evaluates overall alert health in the SWOSH environment, separates real incidents from noise, and prioritizes the narrowest safe fixes for alerts that are flapping, too broad, too sensitive, stale, or not being handled effectively.

Related metrics

• Active Alerts per Node measures the average active alert load per monitored node, giving a quick view of overall alert pressure.
• Trigger/Reset Trend measures the net change in alerts over the last hour, indicating whether alerts are clearing faster than they are arriving or continuing to accumulate.
• Max Hit Rate by Config shows the worst-case saturation of a single alert rule across its covered entities, helping expose overly broad or highly sensitive rules.
• Critical Alerts Unacknowledged measures the share of active critical alerts with no acknowledgement, reflecting whether urgent issues are being noticed and owned quickly enough.
• Action Failure Ratio tracks the share of alert actions that fail, showing whether alert-driven automation is working reliably.

Repair Alert Automation

Repair Alert Automation focuses on the alert action path rather than alert logic itself. It diagnoses and repairs failures in action assignments, action execution, and skip-control behavior, while explicitly excluding threshold tuning, sustain, severity, muting, and disabling. The goal is to identify whether the dominant issue is missing coverage, broken execution, or storm-induced skipping, then fix the narrowest part of the action path until failed-config and uncovered-trigger counts improve.

Related metrics

• Failed Configs (24h) counts enabled configurations with at least one failed action event in the last 24 hours and highlights broken execution paths affecting multiple alert definitions.
• Action Success Ratio (24h) measures the fraction of action events in the last 24 hours that completed successfully, making it the main health signal for automation execution quality.
• Uncovered Configs (24h) counts enabled configurations with at least 3 trigger events but no action events in the last 24 hours, revealing alert rules that are firing without downstream automation coverage.

Cleanup Monitoring Inventory

Cleanup Monitoring Inventory reduces clutter and stale data across monitored nodes, interfaces, and applications without using irreversible actions. It retires ghost nodes, idle interfaces, and zombie applications through reversible cleanup only, keeps batches small and auditable, and improves the signal operators see in dashboards and search results.

Related metrics

• stale_nodes_count counts managed nodes that are ghosted or have not reported in 30+ days.
• unused_interfaces_count counts admin-up interfaces with zero traffic over the last 90 days.
• zombie_applications_count counts managed SAM applications whose latest status timestamp is older than 14 days.
• inventory_retention_ratio measures the percentage of managed nodes that produced useful polling in the last 7 days.

Prevent Capacity Incidents

Prevent Capacity Incidents is aimed at forecasting and preventing resource-exhaustion outages before they create incidents. It uses SolarWinds depletion-date forecasts, along with trending and current-state thresholds as fallback tiers, to surface nodes and volumes at risk across CPU, memory, disk, and bandwidth so approved remediation can happen before users are paged.

Related metrics

• active_node_exhaustion counts nodes currently above 95 percent CPU or memory utilization, highlighting active compute exhaustion events.
• active_volume_exhaustion counts volumes with less than 5 percent available space, highlighting current storage exhaustion risk.
• forecast_cpu_critical_30d measures how many nodes are forecast to hit critical CPU thresholds within 30 days, giving early warning for compute saturation.
• forecast_memory_critical_30d measures how many nodes are forecast to hit critical memory thresholds within 30 days, giving early warning for memory pressure.
• forecast_volume_critical_30d tracks volumes forecast to hit critical disk thresholds within 30 days, helping teams address depletion risk before storage incidents occur.
• bandwidth_saturation_interfaces counts admin-up interfaces sustaining more than 85 percent utilization in either direction, surfacing network links that may be nearing capacity limits.

Ensure Config Backups

Ensure Config Backups maintains healthy backup coverage across the NCM-managed device fleet. It keeps every device on a recent successful Running config archive, holds backup-freshness coverage above 95 percent, drives transfer-job failures to zero, and uses backup-health reporting and schedule checks to surface gaps quickly.

Related metrics

• devices_without_recent_backup counts NCM-managed devices without a successful Running config backup in the last 7 days.
• backup_jobs_failed_24h tracks NCM transfer jobs that ended in an error state within the last 24 hours.
• backup_freshness_coverage_pct measures the percentage of NCM-managed devices with a Running backup in the last 2 days.

Reduce Compliance Violations

Reduce Compliance Violations is focused on lowering current NCM policy violations across network infrastructure by auditing violations, generating and registering remediation scripts for uncovered rules, and executing approved remediations. The goal supports posture hardening against CIS, NIST 800-53, and STIG frameworks while building a reusable remediation library over time.

Related metrics

• open_violations_count counts open NCM policy violations across all managed devices and serves as the core measure of current compliance exposure.
• violation_severity_score measures a severity-weighted violation total, helping prioritize the most serious compliance gaps.
• script_coverage_pct tracks the percentage of currently violated policy rules that already have remediation scripts attached, showing how much of the problem space is ready for automated or repeatable response.
• compliance_evidence_age_minutes measures the age of the stalest running-config evidence across NCM-managed devices, indicating whether compliance results are being scored against fresh enough backup data.

Remediate Config Drift

Remediate Config Drift is focused on detecting and resolving startup-versus-running configuration drift across NCM-managed devices before a reboot turns unsaved changes into an outage. The goal is to identify drifting devices, classify whether drift reflects legitimate pending change or erratic behavior, and then drive the appropriate remediation path with safety checks.

Related metrics

• config_drift_node_count counts distinct NCM-managed devices whose latest startup-versus-running comparison flags configuration drift, making it the primary indicator of pre-outage drift risk.