Anomaly Detection

Home > Select Project > Alert > Event Configuration > Anomaly detection tab

Anomaly detection finds patterns where metric data rises or falls differently from usual and triggers events. You can choose between learning the normal range automatically and setting the sensitivity yourself.

Screen Layout

The Anomaly detection tab consists of two sections, Automatic Baseline and Adaptive Range, each using a different method to detect anomalies.

Section	Description
Automatic Baseline	Learns time-of-day and day-of-week patterns from past data and sets the normal range automatically. You only set the target and the trigger condition
Adaptive Range	Adjusts the normal range based on the sensitivity (sensitive, normal, insensitive) set for each metric. You set the category, field, filter, and pattern sensitivity

Note

Automatic Baseline is currently available only for Application Monitoring (Java, Node.js, Python, PHP, .NET, and Go).

Anomaly detection events are state-based. When an anomaly is detected, an occurrence alert is sent, and when the metric returns to normal, a resolution alert is sent.

Default Options

• Search: Search for events by selecting an event name or an event recipient tag

• Add Alert Policy: Add a new anomaly detection event

• Fold: Collapse or expand the section

Automatic Baseline List

Target to the right of the section title shows the number of targets currently configured and the maximum number of targets allowed in the project (for example, 2/20). Disabled rules also count toward the target number. When the number reaches the maximum, delete rules you no longer use.

Item	Description
No.	Row number
Activation	Toggle that turns the rule on or off. Turning it off does not delete the rule
	Edit the rule
Event name	Rule name
Range	Unit the rule applies to (project, agent, or agent kind)
Level	Alert levels with configured trigger conditions (Critical, Warning, Info)
Target	Targets selected when the range is agent or agent kind. - for project range
Silent	Time during which the same event is not triggered again after it occurs
Reception tag	Recipient tags that receive the alert. Receive all if none is set
	Delete the rule

The list always shows one project-range row per template. Turning on the toggle of a row without a rule creates a rule with the default condition (Critical level, 3 consecutive occurrences). Deleting the rule of a project row keeps the row and resets only its settings.

Adaptive Range List

Item	Description
No.	Row number
Activation	Toggle that turns the rule on or off. When off, conditions are not checked
	Edit the rule
Event name	Rule name
Level	Event severity (Critical, Warning, Info)
Category	Metrics category to detect anomalies in
Field	Metric (metrics field) to detect anomalies in
Filter	Condition that limits the data range for anomaly detection
Rising/Falling pattern	Sensitivity of the rising and falling patterns
	Delete the rule

Event Configuration

Add anomaly detection events in each section. For Automatic Baseline, select a template and targets and set only the trigger condition. For Adaptive Range, specify the category, field, and pattern sensitivity yourself.

Add Automatic Baseline Rules

1. Click the [ Add Alert Policy ] button at the top right of the Automatic Baseline section.

2. In the Automatic Baseline window, configure Select event target, Basic information and notification setting, and Simulation in order.

3. Click the [ Save ] button.

Select Event Target

1. From the Range dropdown, select Agent or Agent kind.

2. From the Target dropdown, select the targets to apply the event to. You can select multiple targets.

Rules that apply to the whole project are configured in the project row of the list, not with Add. Click the icon in the project row.

Basic Information and Notification Setting

1. Use the Activate events toggle to set whether the rule runs.

2. From the Templates dropdown, select the metric template to detect. Currently, the error rate template (Error Rate Anomaly) is available. You cannot change the template after creating the rule.

3. Enter the Event name and Message. Variables in the message are replaced with actual values when the event occurs.

   Note

   Available variables

   • ${metricValuePer}: Error rate (%)
   • ${metricThresholdPer}: Baseline (%)
   • ${errorCount}: Error count
   • ${txCount}: Request count
   • ${runLength}: Consecutive occurrence count

   Check the variables available for each template in the Available variables tooltip next to the message field.

4. In Number of event, set the trigger condition for each level (Critical, Warning, Info). Anomalies are judged every 5 minutes, and you can choose one of two methods.

   • Consecutive triggers the event when n anomaly judgments occur in a row. Enter n between 1 and 288.
   • In the last triggers the event when n anomaly judgments occur within the selected period. Choose a period between 5 minutes and 24 hours. The period cannot be shorter than n × 5 minutes.

   You can set one condition per level, up to three, and at least one must be enabled. The default is 3 consecutive occurrences at the Critical level (about 15 minutes).

5. From the Silent dropdown, select how long the same event is not triggered again after it occurs.

6. Set the Reception tag and Event operation time. For details, see Event Recipient Tags and Event Active Time.

Simulation

After setting the conditions, click the [ Simulation ] button to check the expected number of alerts when the conditions are applied to past data. The chart shows the error rate, the band from the normal range to the threshold, and the event occurrence periods. The lookup period is up to 30 days.

Add Adaptive Range Rules

1. Click the [ Add Alert Policy ] button at the top right of the Adaptive Range section.

2. Configure Event Basic Information, Metrics, Anomaly Detection, and Additional Information in order.

Event Basic Information

1. Select the event level (Critical, Warning, Info).

   • This determines the event priority and alert level.

2. Enter the alert message to be delivered when the event is triggered.

   • You can use variables in the message to include actual values at the time the event occurs.
   Note

   Available Variables

   • $pcode: Project code
   • $category: Category
   • $field: Field
   • $value: Triggered value
   • $oname: Event target

Metrics

1. Select a Category.

   • This category serves as the baseline for the metric data used to detect anomalies.

2. Select the Field to be used for the event trigger conditions. Multiple selections are supported.

3. Select filters that define the event condition targets used to narrow the event scope. Multiple selections are supported.

Anomaly Detection

1. Select the sensitivity levels for Rising Pattern and Falling Pattern.

2. Use the toggle buttons to enable or disable each pattern.

   • To detect only rising patterns: Rising Pattern ON, Falling Pattern OFF

   • To detect only falling patterns: Falling Pattern ON, Rising Pattern OFF

Additional Information

Event Active Time

Configure tags to control when an event runs, such as working hours, non-working hours, or maintenance windows. If no tag is set, the event runs continuously for 24 hours while it is enabled.

1. Click + Add.

2. Under Event Active Time, click + Create New Tag.

3. In Create Event Active Time Tag, select a Tag Name, Days, Time, and Color, then click the [ Apply ] button.

4. Created tags appear in the tag list and can be applied by selecting the checkbox.

5. To edit or delete a tag, click the icon and modify or remove it in Edit Event Active Time Tag.

Caution

When a tag is deleted, it is removed from all users to whom it is applied. However, tags that are currently in use by event rules cannot be deleted.

Event Recipient Tags

When event recipient tags are configured, notifications are sent to project members who have those tags. If no recipient tag is set, notifications are sent to all users in the project.

1. Click + Add Tag or the + icon.

2. Click + Create New Tag at the bottom of the Event Recipient Tags window.

3. In the Create Tag window, enter a tag name, select a color, and click the [ Create Tag ] button.

4. To edit or delete a created tag, click the icon in the tag list.

5. Select the desired tag from the Tag List in the Event Recipient Tags window to apply it.

Tip

When configuring events, selecting event recipient tags allows notifications to be sent to project members and third-party plugins associated with those tags. You can assign tags to project members and third-party plugins separately via Alert > Notifications.

Edit Event

1. Go to the Alert > Event Configuration > Anomaly detection tab.

2. Click the icon in the row of the rule you want to edit.

3. In the settings window, update the options and click the [ Save ] button.

For Automatic Baseline rules, you can edit everything except the template, such as the range, targets, and trigger conditions.

Delete Event

1. Go to the Alert > Event Configuration > Anomaly detection tab.

2. Click the icon in the row of the rule you want to delete.

3. In the delete confirmation window, click the [ Delete ] button.