Detection rules

The rules determine when an alert should be opened. At least one of the two methods must be configured.

Anomaly detection

Anomaly detection uses machine learning to identify behaviors outside the historical pattern of the metric. The model considers the seasonality and trend of the series to determine what is expected for each period, and compares the observed value against that band.

When enabling anomaly detection, you can configure the direction:

• High: alerts only when the value rises beyond expected.
• Low: alerts only when the value falls below expected.
• Both: alerts on any significant deviation.

The direction applies only to anomaly detection. Conditions compare the value against a fixed threshold and do not depend on it.

The behavior of the model can be tuned in the advanced settings.

Conditions

Conditions are manual rules that compare the current value of an aggregation against a defined threshold. The condition is met when the value exceeds the configured limit.

Multiple conditions can be configured in the same monitor, over any aggregation of the metric, including one different from the aggregation chosen for anomaly detection. All configured conditions must be met in the same measurement for the alert to open.

Thresholds over duration aggregations are entered as time (2 days, 30 min) and displayed in the same format.

Combining the methods

With only one of the methods enabled, it alone determines whether the alert is opened.

When both are enabled in the same monitor, the alert is opened only if both are satisfied in the same measurement: anomaly detection must report a significant deviation in one of the monitored directions, and every condition must be met. An anomaly with no condition met, or a condition met with no anomaly, opens no alert.

If the aggregation used by a condition has no value in the analyzed interval, the condition is considered not met and no alert is opened, even if anomaly detection reported a deviation.

The same criterion applies to closing: the consecutive measurements required to normalise an alert count only those in which the set of rules is no longer satisfied.