...
Seasonality (Hourly, Daily):
Hourly: This setting is used for metrics that display hourly cyclic behavior. For instance, if your log data typically fluctuates each hour based on user activity or background processes, setting the seasonality to Hourly enables the SARIMA model to capture these hourly patterns accurately.
Daily: This setting captures daily seasonality, suitable for log metrics with a daily recurring pattern. For example, if log entries spike every evening due to daily system maintenance tasks, setting the seasonality to Daily allows the model to recognize these daily trends.
Bands (1, 2, 3):
Band 1 (Narrow): Offers high sensitivity by setting a tighter range around predicted values, detecting even minor deviations. This band is useful when you need to capture subtle changes in log volume that might indicate early signs of issues.
Band 2 (Moderate): Provides a moderate range, making the algorithm less sensitive to minor fluctuations and ideal for monitoring with fewer false positives.
Band 3 (Wide): Defines the widest range, capturing only significant deviations. This setting is suitable for metrics where only large, impactful anomalies are of interest, reducing alert noise for minor variations.
robust
Implements the Seasonal decompose algorithm.
sampling interval
Sampling intervals are 1m, 2m, 3m, 5m, 10m, 15m, 30m, 1h, and 2h.
Numeric parameter
Has the possible values of 1, 2, or 3.The Robust Anomaly Detection algorithm uses a seasonal decomposition technique to identify anomalies in time series data. Seasonal decomposition separates the data into its seasonal, trend, and residual components, allowing for more accurate anomaly detection in metrics with strong seasonal patterns.
Key Arguments
Rolling Window Size:
The rolling window size is used to calculate the standard deviation (std) for anomaly detection and to set the band limits around the expected values.
A larger window size provides a smoother, more stable standard deviation calculation but may be less responsive to sudden, short-term spikes or drops.
A smaller window size is more responsive to recent data points, allowing for a quicker reaction to changes but may lead to more noise.
Bands (1, 2, 3):
Band 1 (Narrow)
Band 2 (Moderate)
Band 3 (Wide)
agile-robust
The Agile Robust Anomaly Detection algorithm applies the Prophet model to detect anomalies in log metrics with recurring patterns and occasional level shifts. This approach is especially useful for identifying irregularities in logs that exhibit seasonal behaviors, such as error spikes, request rates, or event frequencies, which follow daily or hourly patterns.
Key Arguments
Seasonality (Hourly, Daily):
Hourly: This setting is used for log metrics that exhibit hourly patterns within a 24-hour cycle. For example, if your error logs tend to spike each hour due to automated checks or periodic background processes, selecting Hourly allows the algorithm to model these regular occurrences and detect deviations that fall outside the norm.
Daily: This setting captures daily seasonality, making it useful for metrics that show daily patterns. For instance, a daily surge in user login errors each morning when users start their workday would be expected. With Daily seasonality, the algorithm anticipates these recurring daily trends, flagging only unusual changes outside the expected pattern.
Bands (1, 2, 3):
Band 1 (Narrow)
Band 2 (Moderate)
Band 3 (Wide)
...