| 1 | # Anomaly Advisor Tab |
| 2 | |
| 3 | The **Anomaly Advisor** tab helps you identify potentially anomalous metrics and charts by focusing on a highlighted timeframe of interest. This feature uses Netdata's **Anomaly Rate ML scoring** to rank metrics based on unusual behavior. |
| 4 | |
| 5 | Each chart in the [Metrics tab](/docs/dashboards-and-charts/metrics-tab-and-single-node-tabs.md) also features an [Anomaly Rate ribbon](/docs/dashboards-and-charts/netdata-charts.md#anomaly-rate-ribbon) for anomaly visibility. |
| 6 | |
| 7 | For configuration details, see the [ML documentation](/src/ml/README.md). |
| 8 | |
| 9 | ## How Anomaly Advisor Works |
| 10 | |
| 11 | The Anomaly Advisor leverages Netdata’s machine learning to evaluate anomaly rates across your nodes. It provides three key visualizations: |
| 12 | |
| 13 | | Chart Name | Purpose | Why It Matters | |
| 14 | |-------------------------------|--------------------------------------------------------------------|-------------------------------------------------------| |
| 15 | | **Anomaly Rate** | Shows the percentage of anomalous metrics over time per node. | Helps you quickly spot nodes behaving abnormally. | |
| 16 | | **Count of Anomalous Metrics**| Displays raw counts of anomalous metrics per node. | Useful when nodes have different numbers of metrics. | |
| 17 | | **Anomaly Events Detected** | Indicates when the anomaly rate has triggered a node-level event. | Focuses your attention on meaningful spikes, not noise. | |
| 18 | |
| 19 | :::note |
| 20 | |
| 21 | **Anomaly Events Detected** appear slightly after anomaly rates rise, as they require a significant portion of metrics on the node to show anomalous behavior. |
| 22 | |
| 23 | ::: |
| 24 | |
| 25 | ## Workflow Overview |
| 26 | |
| 27 | 1. **Highlight a timeframe of interest** on the anomaly charts. |
| 28 | 2. An ordered list of related charts appears, ranked by anomaly level. |
| 29 | 3. The **Anomaly Rate ribbon** (purple) is visible on each chart. |
| 30 | 4. Use the right-hand anomaly index to sort metrics from most to least anomalous. |
| 31 | 5. Click an entry in the index to navigate directly to the corresponding chart. |
| 32 | |
| 33 | :::tip |
| 34 | |
| 35 | Use the [node filter](/docs/dashboards-and-charts/node-filter.md) to focus on specific nodes before highlighting a timeframe. |
| 36 | |
| 37 | ::: |
| 38 | |
| 39 | ## Usage Tips |
| 40 | |
| 41 | | Tip | Why It Matters | |
| 42 | |------------------------------------------------|------------------------------------------------------------------| |
| 43 | | Filter to specific nodes before highlighting. | Reduces noise by limiting averaging across unrelated nodes. | |
| 44 | | Highlight close to the anomaly spike. | Improves ranking accuracy by focusing on the relevant timeframe. | |
| 45 | |
| 46 | ## Anomaly Advisor Diagram |
| 47 | |
| 48 | ```mermaid |
| 49 | flowchart TD |
| 50 | A("Highlight Timeframe") --> B("Rank Metrics by Score") |
| 51 | B --> C("Show Ordered Charts") |
| 52 | C --> D("Pick from Anomaly Index") |
| 53 | D --> E("Investigate Metrics") |
| 54 | |
| 55 | %% Style definitions |
| 56 | classDef alert fill:#ffeb3b,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 57 | classDef neutral fill:#f9f9f9,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 58 | classDef complete fill:#4caf50,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 59 | classDef database fill:#2196F3,stroke:#000000,stroke-width:3px,color:#000000,font-size:14px |
| 60 | |
| 61 | %% Apply styles |
| 62 | class A alert |
| 63 | class B,C neutral |
| 64 | class D,E complete |
| 65 | ``` |
| 66 | |
| 67 | :::tip |
| 68 | |
| 69 | This diagram shows the Anomaly Advisor flow: highlight, rank, and explore. Use the ranking to prioritize which charts to investigate. |
| 70 | |
| 71 | ::: |