# below are some examples of using the `anomaly-bit` option to define alerts based on anomaly # rates as opposed to raw metric values. You can read more about the anomaly-bit and Netdata's # native anomaly detection here: # https://learn.netdata.cloud/docs/agent/ml#anomaly-bit---100--anomalous-0--normal # some examples below are commented, you would need to uncomment and adjust as desired to enable them. # node level anomaly rate # https://learn.netdata.cloud/docs/agent/ml#node-anomaly-rate # if node level anomaly rate is above 1% then warning (pick your own threshold that works best via trial and error). template: ml_1min_node_ar on: anomaly_detection.anomaly_rate class: Workload type: System component: ML lookup: average -1m of anomaly_rate calc: $this units: % every: 30s warn: $this > 1 summary: ML node anomaly rate info: Rolling 1min node level anomaly rate to: silent # alert per dimension example # if anomaly rate is between 5-20% then warning (pick your own threshold that works best via tial and error). # if anomaly rate is above 20% then critical (pick your own threshold that works best via tial and error). # template: ml_5min_cpu_dims # on: system.cpu # lookup: average -5m anomaly-bit foreach * # calc: $this # units: % # every: 30s # warn: $this > (($status >= $WARNING) ? (5) : (20)) # crit: $this > (($status == $CRITICAL) ? (20) : (100)) # info: rolling 5min anomaly rate for each system.cpu dimension # alert per chart example # if anomaly rate is between 5-20% then warning (pick your own threshold that works best via tial and error). # if anomaly rate is above 20% then critical (pick your own threshold that works best via tial and error). # template: ml_5min_cpu_chart # on: system.cpu # lookup: average -5m anomaly-bit of * # calc: $this # units: % # every: 30s # warn: $this > (($status >= $WARNING) ? (5) : (20)) # crit: $this > (($status == $CRITICAL) ? (20) : (100)) # info: rolling 5min anomaly rate for system.cpu chart