Outlier Detection¶

Through algorithm analysis of metrics or statistical data of detection objects within specific groups, significant outlier deviations can be identified. If the detected inconsistency exceeds the preset threshold, the system will generate an outlier detection anomaly event for subsequent alert tracking and analysis. This method helps to promptly detect and handle potential abnormal situations, improving the accuracy and response speed of monitoring.

Use Cases¶

Based on the characteristics of metric data, appropriate distance parameters can be configured to trigger emergency events when data significantly deviates from the normal range. For example, you can set up monitoring so that when the memory usage of a host is significantly higher than other hosts, the system can issue an alert in time. Such configuration helps to quickly identify and respond to potential performance issues or abnormal situations.

Configuration¶

Detection Frequency¶

Automatically matches the selected detection interval. The default is 5 minutes.

Detection Interval¶

The time range for querying detection metrics.

Detection Metrics¶

The metric data being monitored.

Trigger Conditions¶

Set the trigger conditions for alert levels: You can configure any one of the emergency, normal, data gap, and information trigger conditions.

Configure trigger conditions and severity. When the query result is multiple values, any value that meets the trigger condition will generate an event.

Severity	Description
Emergency (Red)	Use the DBSCAN algorithm, configure appropriate distance parameters based on metric data characteristics to trigger emergency events. The distance parameter represents the maximum distance between two samples where one sample is adjacent to another, not the maximum limit of the intra-cluster point distance. (float, default=0.5) You can configure any floating-point value in the range(0-3.0). If not configured, the default distance parameter is 0.5. The larger the distance setting, the fewer the outlier points detected. If the distance value is set too small, many outliers may be detected. If the distance value is set too large, no outliers may be detected. Therefore, it is necessary to set an appropriate distance parameter based on different data characteristics.
Normal (Green)	You can configure the number of times. If the detection metric triggers an "emergency" anomaly event, and then the next N consecutive detections are normal, a "normal" event will be generated. Used to determine whether the anomaly event has returned to normal, recommended to configure.

Data Gap¶

For data gap status, seven strategies can be configured.

1. Link to the detection interval time range, judge the query result of the recent minutes of the detection metric, do not trigger an event;

2. Link to the detection interval time range, judge the query result of the recent minutes of the detection metric, the query result is considered as 0; at this time, the query result will be re-compared with the threshold configured in the Trigger Conditions above to determine whether to trigger an anomaly event.

3. Custom fill the detection interval value, trigger data gap event, trigger emergency event, trigger important event, trigger warning event, and trigger recovery event; when selecting this type of configuration strategy, it is recommended to configure the custom data gap time >= detection interval time interval. If the configured time <= detection interval time interval, there may be situations where both data gap and anomaly conditions are met. In this case, only the data gap processing result will be applied.

Information Generation¶

Enable this option to generate "information" events for detection results that do not match the above trigger conditions.

Other Configuration¶

For more details, refer to Rule Configuration.