Skip to content

Commit

Permalink
Merge pull request #16733 from newrelic/daily-release/Mar-29-2024-5_17
Browse files Browse the repository at this point in the history 
Daily release/mar 29 2024 5 17
  • Loading branch information
@akristen
akristen authored Mar 29, 2024
2 parents 37c505f + add3bc8 commit 218269c
Show file tree
Hide file tree
Showing 10 changed files with 278 additions and 172 deletions.
27 changes: 14 additions & 13 deletions ...pplied-intelligence/applied-intelligence/anomaly-detection/custom-anomalies.mdx
View file
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
---
title: Custom anomaly detection
title: Anomaly detection
tags:
- Alerts and applied intelligence
- Applied intelligence
- Proactive detection
metaDescription: Learn how custom anomaly detection in New Relic notifies you of unusual app behavior.
- Anomaly detection
- Alerts
metaDescription: Learn how anomaly detection in New Relic notifies you of unusual app behavior.
redirects:
- /docs/alerts-applied-intelligence/new-relic-alerts/advanced-alerts/other-condition-types/create-anomaly-alert-conditions
- /docs/alerts/new-relic-alerts/defining-conditions/create-anomaly-alert-conditions
Expand All @@ -24,24 +25,24 @@ import alertsFacetedAnomaliesTwo from 'images/alerts_screenshot-full_faceted-ano

import alertsAnomaliesSetUpperandLowerRanges from 'images/alerts_screenshot-full_anomalies-set-upper-and-lower-ranges.webp'

Custom anomalies allow your team the most versatility when detecting unusual behavior in your system. Not only are they flexible and dynamic, custom anomalies provide your team with the ability to alert on any entity or signal and to adjust and optimize your thresholds. Custom anomalies are built using the same advanced tuning settings as static alerting so you can ensure your team sees only incidents that are important to you.
Anomaly detection allows your team the most versatility when detecting unusual behavior in your system. Anomaly detection gives your team the ability to alert on any entity or signal and to adjust and optimize your sensitivity thresholds. Anomaly detection uses the same streaming-alerting pipeline as static threshold alerts and shares the same advanced tuning settings. This ensures that the stream processing is aligned to your telemetry signal's characteristics to reduce false alerting.

You can also enrich your custom anomaly detection configuration with additional metadata to provide further context and add custom incident descriptions that can provide additional instructions to your on-call engineers.
You can also enrich your anomaly detection configuration with additional metadata to provide further context and add custom incident descriptions that can provide additional instructions to your on-call engineers.

## Configure custom anomaly thresholds [#configure-custom-anomalies]
## Configure anomaly sensitivity thresholds [#configure-custom-anomalies]

You can create custom anomalies thresholds from an [alert condition](/docs/alerts-applied-intelligence/new-relic-alerts/alert-conditions/create-nrql-alert-conditions/). Here are some tips for setting anomaly thresholds:
You can create anomaly sensitivity thresholds from an [alert condition](/docs/alerts-applied-intelligence/new-relic-alerts/alert-conditions/create-nrql-alert-conditions/). Here are some tips for setting anomaly thresholds:

* Set the [anomaly direction](#anomaly-direction) to monitor incidents that happen either above or below the anomaly.
* Use the slider bar to adjust the <DoNotTranslate>**Critical**</DoNotTranslate> threshold sensitivity, represented in the preview chart by the light gray area around the anomaly. The tighter the band around the anomaly, the more sensitive it is and the more incidents it will generate.
* Use the slider bar to adjust the <DoNotTranslate>**Critical**</DoNotTranslate> sensitivity threshold, represented in the preview chart by the light gray area around the signal. The tighter the band around the signal, the more sensitive it is and the more incidents it will generate.
* You can create a [<DoNotTranslate>**Warning**</DoNotTranslate> threshold](/docs/alerts-applied-intelligence/new-relic-alerts/advanced-alerts/advanced-techniques/set-thresholds-alert-condition/#threshold-levels) (the darker gray area around the anomaly).


Follow these steps to create your custom anomaly:
Follow these steps to create an anomaly detection alert condition:

1. Go to <DoNotTranslate>**[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Alerts & AI > Alert Conditions**</DoNotTranslate>.

2. Click <DoNotTranslate>**+ New alert condition > Use guided mode**</DoNotTranslate>.
2. Click <DoNotTranslate>**+ New alert condition > Use guided mode**</DoNotTranslate> (or the more advanced Query mode).

3. Go through the guided steps until you get to <DoNotTranslate>**Set thresholds**</DoNotTranslate>.

Expand All @@ -54,7 +55,7 @@ Follow these steps to create your custom anomaly:
src={alertsTryAnomalyThresholds}
/>

5. Configure the settings for one or more thresholds. Anomaly detection makes a prediction on what the next data point will be based on prior activity. The threshold value for custom anomaly detection is the number of standard deviations your signal value is away from the value that was predicted.
5. Configure the settings for one or more thresholds. Anomaly detection makes a prediction on what the next data point will be based on prior activity. The threshold value for anomaly detection controls the sensitivity of the alert condition for tolerating how far off the actual value is from the predicted value. The threshold is the number of standard deviations your signal value is away from the value that was predicted. We track the standard deviation between the predicted value and the actual value for the prior 7 days of data.

To configure the threshold, you'll need to:

Expand Down Expand Up @@ -97,7 +98,7 @@ Here are examples of how large fluctuations in your data would be treated under

The algorithm for calculating the prediction is mathematically complex. Here are some of the major rules governing its predictive abilities:

* <DoNotTranslate>**Age of data**</DoNotTranslate> On initial creation, the prediction is calculated using between 1 to 4 weeks of data, depending on data availability and prediction type. After its creation, the algorithm takes into account ongoing data fluctuations over a long time period, although greater weight is given to more recent data. For data that has only existed for a short time, the predicted value will likely fluctuate a good deal and not be very accurate. This is because there isn't enough data to determine its usual values and behavior. The more history the data has, the more accurate the prediction and thresholds will become.
* <DoNotTranslate>**Consistency of data**</DoNotTranslate> For metric values that remain in a consistent range or that trend slowly and steadily, their more predictable behavior means that their thresholds will become tighter around the prediction. Data that is more varied and unpredictable will have looser (wider) thresholds.
* <DoNotTranslate>**Age of data**</DoNotTranslate> On initial creation, the prediction is calculated using between 1 to 4 weeks of data, depending on data availability and prediction type. Currently, queries that use the `FACET` clause aren't trained on stored data. After its creation, the algorithm takes into account ongoing data fluctuations over a long time period, although greater weight is given to more recent data. For data that has only existed for a short time, the predicted value will likely fluctuate a good deal and not be very accurate. This is because there isn't enough data to determine its usual values and behavior. The more history the data has, the more accurate the prediction will become.
* <DoNotTranslate>**Consistency of data**</DoNotTranslate> For metric values that remain in a consistent range or that trend slowly and steadily, their more predictable behavior means that their sensitivity thresholds will become tighter around the prediction. Data that is more varied and unpredictable will have looser (wider) sensitivity thresholds.
* <DoNotTranslate>**Regular fluctuations**</DoNotTranslate> For shorter-than-one-week cyclical fluctuations (such as weekly Wednesday 1pm deployments or nightly reports), the prediction algorithm looks for these cyclical fluctuations and attempts to adjust to them.

87 changes: 2 additions & 85 deletions ...s-applied-intelligence/new-relic-alerts/get-started/alerts-ai-overview-page.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ redirects:
freshnessValidatedDate: never
---

On the <InlinePopover type="alerts" /> <DoNotTranslate>**Overview**</DoNotTranslate> page, you'll find a consolidated view of your current alerts incidents. The <DoNotTranslate>**Issues & activity**</DoNotTranslate> page has views of your active issues, recent incidents, and anomalies.
On the <InlinePopover type="alerts" /> <DoNotTranslate>**Overview**</DoNotTranslate> page, you'll find a consolidated view of your current alerts incidents. The <DoNotTranslate>**Issues & activity**</DoNotTranslate> page has views of your active issues and recent incidents.

## Why it matters [#why]

The <DoNotTranslate>**Overview**</DoNotTranslate> and <DoNotTranslate>**Issues & activity**</DoNotTranslate> pages provide analytics on how your system is (or isn't) performing. You can quickly switch between the [<DoNotTranslate>**Overview**</DoNotTranslate>](#summary), [<DoNotTranslate>**Issues**</DoNotTranslate>](#issues), [<DoNotTranslate>**Incidents**</DoNotTranslate>](#incidents), and [<DoNotTranslate>**Anomalies**</DoNotTranslate>](#anomalies) to scan for critical problems affecting your systems.
The <DoNotTranslate>**Overview**</DoNotTranslate> and <DoNotTranslate>**Issues & activity**</DoNotTranslate> pages provide analytics on how your system is (or isn't) performing. You can quickly switch between the [<DoNotTranslate>**Overview**</DoNotTranslate>](#summary), [<DoNotTranslate>**Issues**</DoNotTranslate>](#issues) and [<DoNotTranslate>**Incidents**</DoNotTranslate>](#incidents) to scan for critical problems affecting your systems.

## Overview page [#summary]

Expand Down Expand Up @@ -356,86 +356,3 @@ Click an incident's row to see the incident's details.
</tbody>
</table>

## Anomalies

On the <DoNotTranslate>**Issues & activity**</DoNotTranslate> page, anomalies are outliers in your system's performance and operation that might be the sign of a problem. See every anomaly in one place. You can filter your anomalies by anomaly state, entity, configuration and configuration type.

By default, this page shows a list of all your recent anomalies in the selected account. Select an anomaly to view a detailed analysis and more context.

### Anomalies feed columns

<table>
<thead>
<tr>
<th style={{ width: "200px" }}>
Column name
</th>

<th>
Explanation
</th>
</tr>
</thead>

<tbody>
<tr>
<td>
State of anomaly
</td>

<td>
Values: open or closed.
</td>
</tr>

<tr>
<td>
Anomaly category
</td>

<td>
Values: error rate, web throughput, non-web throughput.
</td>
</tr>

<tr>
<td>
(no column name)
</td>

<td>
A graph to illustrate the anomaly.
</td>
</tr>

<tr>
<td>
Start time
</td>

<td>
How long ago the anomaly started.
</td>
</tr>

<tr>
<td>
Duration
</td>

<td>
How long the anomaly lasted.
</td>
</tr>

<tr>
<td>
Entity
</td>

<td>
Name of the entity.
</td>
</tr>
</tbody>
</table>
Loading

0 comments on commit 218269c

Please sign in to comment.