I've written an hourly report which utilizes static thresholds. Which are stored in a config file. I think the report would be more meaningful with dynamic thresholds. I'm wanting input about the best way to do dynamic thresholds. Anything at all is appreciated.
The report contains http error code counts and offending urls.
Why use thresholds? So the script which generates the report can intelligently send pages.
My plan is to calculate a normal/standard distribution based on a floating 24 hours worth of results.