APM Metrics Anomaly Detection¶

Used to monitor key metrics data of APM within the workspace. The system counts the number of traces meeting the conditions within a specified time period and triggers an anomaly event when it exceeds a custom threshold.

Detection Configuration¶

Detection Frequency¶

The execution frequency of the detection rule.

Detection Interval¶

The time range for querying metrics each time the task is executed. The selectable detection intervals vary depending on the detection frequency.

Detection Metrics¶

Set the metrics for detection data, which can be used to configure the metrics data of services within the workspace for a specified time range.

Trigger Conditions¶

Set the trigger conditions for alert severity levels: You can configure any one of the trigger conditions for Critical, Important, Warning, or Normal.

Configure the trigger conditions and severity. When the query result contains multiple values, an event is generated if any value meets the trigger condition.

For more details, refer to Event Level Description.

Consecutive Trigger Judgment¶

If Consecutive Trigger Judgment is enabled, it means an event is generated only after the trigger condition is met consecutively for a specified number of times. The maximum limit is 10 times.

Bulk Alert Protection¶

Enabled by default.

When the number of alerts generated in a single detection exceeds a preset threshold, the system automatically switches to a status summary strategy: instead of processing each alert object individually, it generates a small number of summary alerts based on event status and pushes them.

This ensures the timeliness of notifications while significantly reducing alert noise and avoiding timeout risks caused by processing too many alerts.

Alert Level¶

1. Alert Level Critical (red), Important (orange), Warning (yellow);

2. Alert Level Normal (green): Based on the configured number of detection times, explained as follows:

   • Each execution of a detection task counts as 1 detection. For example, if Detection Frequency = 5 minutes, then 1 detection = 5 minutes.
   • The number of detections can be customized. For example, if Detection Frequency = 5 minutes, then 3 detections = 15 minutes.

   Level

   Description

   Normal

   After the detection rule takes effect, if the data detection result returns to normal within the configured custom number of detections after a Critical, Important, or Warning anomaly event is generated, a recovery alert event is generated. ❗️ Recovery alert events are not subject to Alert Silence restrictions. If the number of detections for recovery alert events is not set, the alert event will not recover and will remain in the Events > Unrecovered Events List.

Data Gap¶

Seven strategies can be configured for data gap status.

1. Link with the detection interval time range, judge the query result of the detection metric for the most recent minutes, and do not trigger an event.
2. Link with the detection interval time range, judge the query result of the detection metric for the most recent minutes, and treat the query result as 0. The query result will then be re-compared with the threshold configured in the Trigger Conditions above to determine whether to trigger an anomaly event.
3. Custom fill the detection interval value, trigger a data gap event, trigger a critical event, trigger an important event, trigger a warning event, and trigger a recovery event. For this type of configuration strategy, the recommended custom data gap time configuration is >= the detection interval time span. If the configured time is <= the detection interval time span, situations satisfying both data gap and anomaly conditions may occur; in such cases, only the data gap processing result will be applied.

Information Generation¶

Enable this option to generate "Information" events for detection results that do not match any of the above trigger conditions and write them.

Other Configurations¶

For more details, refer to Rule Configuration.