Anomaly Detection

Anomaly detection uses statistics or machine learning to learn what a metric normally looks like and raise a signal when current values depart from it. Methods range from simple rules, such as three standard deviations from a rolling mean, to models that account for daily and weekly seasonality.

Why it matters

Fixed thresholds struggle with metrics that change by time of day. Traffic of 200 requests per minute is normal at noon and alarming at 4 a.m. in some systems, while a drop to 20 might be an outage. Anomaly detection can catch such cases and spot problems you did not think to write rules for, like a sudden fall in signups.

Example

Metric: orders per minute
Expected for Tuesday 14:00: 40 (range 30-52)
Observed: 9
-> anomaly flagged, severity based on duration

A simple version: alert when the value is more than three standard deviations below the same hour's average over the previous four weeks.

Common mistakes

• Treating the output as truth. Anomalies are unusual, not necessarily bad, such as a successful campaign.
• Training on data that already contains outages.
• Using it for critical conditions that have clear thresholds. Do both.
• Expecting good results on metrics with very little data.

Related

• Baseline
• Threshold alert
• False positive
• Machine learning

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.