Detection rules

The detection rules determine when an alert should be opened. Configure at least one of the two methods, anomaly detection or conditions.

Anomaly detection

Anomaly detection uses machine learning to identify behaviors outside the historical pattern of the metric. The model considers the seasonality and trend of the series to determine what is expected in each period. The model then compares the observed value against that band.

Anomaly detection, when enabled, accepts a direction:

• High: alerts only when the value rises beyond expected.
• Low: alerts only when the value falls below expected.
• Both: alerts on any significant deviation.

The direction applies only to anomaly detection. Conditions compare the value against a fixed threshold and do not depend on the direction.

The behavior of the model is adjustable in the advanced settings.

Conditions

Conditions are manual rules that compare the current value of an aggregation against a defined threshold. The condition is met when the value exceeds the configured threshold.

A monitor accepts several conditions, over any aggregation of the metric, including an aggregation different from the one chosen for anomaly detection. All configured conditions must be met in the same measurement for the alert to be opened.

Thresholds over duration aggregations are entered as time (2 days, 30 min) and displayed in the same format.

Combining the methods

With only one of the methods enabled, that method alone determines the opening of the alert.

With both methods enabled on the same monitor, the alert is opened only if both are satisfied in the same measurement. Anomaly detection must report a significant deviation in one of the monitored directions and every condition must be met. An anomaly with no condition met, or a condition met with no anomaly, opens no alert.

If the aggregation used by a condition has no value in the analyzed interval, the condition is considered not met. No alert is opened, even if anomaly detection reported a deviation.

The same criterion applies to closing: the consecutive measurements required to normalise an alert count only those in which the set of rules is no longer satisfied.