Anomalies FAQ

Questions

What is the difference between an anomaly and an alarm?

The difference is as follows:

• An anomaly is when a key performance indicator (KPI) deviates from its normal behavior. Predictive Insights learns, defines, and refines normal behavior during training. An anomaly might be temporary.
• An alarm is when Predictive Insights determines that a KPI (or multiple KPIs) has deviated to a level where it is a problem and must be investigated.

What is a baseline?

A baseline is a guide to display the upper and lower values within which a KPI tends to appear without its being anomalous. A baseline is learned during training. It is shown in the Predictive Insights user interface by means of a green shaded area.

How is the baseline calculated? How often does Predictive Insights recalculate the baseline?

The baseline is constantly being recalculated. The baseline is defined using the analytics model. The analytics model, once trained, begins retraining immediately. A baseline is created each time we create an analytics model. The first analytics model is, by default, based off 4 weeks of data. After the first model is created retraining of the analytics model occurs by default with each new day of data.

Is the baseline the only way to detect anomalies?

Predictive Insights includes a number of other anomaly detection algorithms that operate completely independently of the baseline. The algorithms operate on anomalies that occur within the baseline, meaning that values can occur within the baseline, yet anomalies might still be detected.

Why are there gaps in the KPI plotline in the user interface?

The colored lines in the UI are the values for the KPI. If these plot line(s), which is the data for your KPI, displays gaps this can be for a number of reasons. Most likely this is because there are gaps in the data for the KPI you are inputting. If, after checking your input data, there are no gaps there are other questions to ask eg. are you loading data in backlog? what is the latency? is the granularity of the data in the UI set to same value as your aggregation interval?

What is steady state?

Steady state is when you are loading for the latest interval which is in near real time. You are in steady state if you are loading your latest data close to now time through mediation and are scoring. Training may happen in steady state but it will take until the end of training period before alarms will appear.

Predictive Insights displays, what looks like, more than one unrelated KPIs together. How does Predictive Insights see this relationship?

Predictive Insights determines that there is a mathematical relationship between these KPIs. For example, in a customer POC Predictive Insights picked up a mathematical relationship between certain metrics. The customers stated that there could not possibly be a relationship between these metrics. This lead them to do investigation. It turned out that these metrics were spiking at the same time on certain nights. They were hosted on separate VMs on the same hardware. On further investigation it turned out that the cleaner would unplug the server to plug in a vacuum cleaner, thus causing anomalies.

What is a causal group?

A causal groups is the group of related metrics (maximum of 6) that are deemed to be related to an anomalous KPI. When you launch an alarm the causal group is displayed in the related metrics tab.

What is a consolidated alarm?

Multiple alarms can be grouped together into one consolidated alarm in the AEL. Each can have a causal group of 6 max which may lead to many related metrics.