Anomaly detection
Anomaly detection identifies measurements that deviate significantly from a metric learned normal behaviour, rather than comparing against a fixed threshold.
What is anomaly detection?
Anomaly detection identifies measurements that deviate significantly from a metric learned normal behaviour, rather than comparing against a fixed threshold.
Plain and technical
Instead of alerting when a number crosses a line somebody guessed, anomaly detection learns what normal looks like for that specific measurement (including that Monday mornings are busy), and alerts when it departs from that.
Effective anomaly detection models seasonality at hourly and weekly granularity, detects deviation in both directions since an unexpected drop is often more significant than a rise, and groups co-moving detections into single findings. Feedback should update the baseline rather than adding suppression rules, which otherwise accumulate until nothing is reported.
What it looks like in practice
Nearby vocabulary
AIOps
AIOps is the application of statistical and machine learning techniques to operational data for detection, correlation and noise reduction.
Monitoring
Monitoring is the practice of collecting predefined signals from a system and alerting when they leave their expected ranges.
Observability
Observability is the property of a system that allows its internal state to be understood from the signals it emits, including for failures nobody anticipated.
How DevOpsArk handles anomaly detection
Articles on this subject
AI-powered incident response: compressing the first ten minutes
Where incident time actually goes, which parts an agent can take over safely, and how to structure incident response so the automation helps rather than adds noise.
Alerting that people still read at 3am
How to build an alerting system with a high proportion of actionable pages: correlation, ownership routing, suppression, and deleting the rules that never produce a decision.
More definitions
See these concepts in a running system
A 30-minute walkthrough against your own infrastructure rather than a slide about the theory.