| 1 | # below are some examples of using the `anomaly-bit` option to define alerts based on anomaly |
| 2 | # rates as opposed to raw metric values. You can read more about the anomaly-bit and Netdata's |
| 3 | # native anomaly detection here: |
| 4 | # https://learn.netdata.cloud/docs/agent/ml#anomaly-bit---100--anomalous-0--normal |
| 5 | |
| 6 | # some examples below are commented, you would need to uncomment and adjust as desired to enable them. |
| 7 | |
| 8 | # node level anomaly rate |
| 9 | # https://learn.netdata.cloud/docs/agent/ml#node-anomaly-rate |
| 10 | # if node level anomaly rate is above 1% then warning (pick your own threshold that works best via trial and error). |
| 11 | template: ml_1min_node_ar |
| 12 | on: anomaly_detection.anomaly_rate |
| 13 | class: Workload |
| 14 | type: System |
| 15 | component: ML |
| 16 | lookup: average -1m of anomaly_rate |
| 17 | calc: $this |
| 18 | units: % |
| 19 | every: 30s |
| 20 | warn: $this > 1 |
| 21 | summary: ML node anomaly rate |
| 22 | info: Rolling 1min node level anomaly rate |
| 23 | to: silent |
| 24 | |
| 25 | # alert per dimension example |
| 26 | # if anomaly rate is between 5-20% then warning (pick your own threshold that works best via tial and error). |
| 27 | # if anomaly rate is above 20% then critical (pick your own threshold that works best via tial and error). |
| 28 | # template: ml_5min_cpu_dims |
| 29 | # on: system.cpu |
| 30 | # lookup: average -5m anomaly-bit foreach * |
| 31 | # calc: $this |
| 32 | # units: % |
| 33 | # every: 30s |
| 34 | # warn: $this > (($status >= $WARNING) ? (5) : (20)) |
| 35 | # crit: $this > (($status == $CRITICAL) ? (20) : (100)) |
| 36 | # info: rolling 5min anomaly rate for each system.cpu dimension |
| 37 | |
| 38 | # alert per chart example |
| 39 | # if anomaly rate is between 5-20% then warning (pick your own threshold that works best via tial and error). |
| 40 | # if anomaly rate is above 20% then critical (pick your own threshold that works best via tial and error). |
| 41 | # template: ml_5min_cpu_chart |
| 42 | # on: system.cpu |
| 43 | # lookup: average -5m anomaly-bit of * |
| 44 | # calc: $this |
| 45 | # units: % |
| 46 | # every: 30s |
| 47 | # warn: $this > (($status >= $WARNING) ? (5) : (20)) |
| 48 | # crit: $this > (($status == $CRITICAL) ? (20) : (100)) |
| 49 | # info: rolling 5min anomaly rate for system.cpu chart |