Detectors

Anomaly ledger

Every row is a detector hit with observed vs baseline values. This is the evidence RCA ranks — not a vibe chart.

TypeServiceSeverityObservedBaselineWindow

No anomalies in memory yet.

Families you should expect

Checkout cascade typically emits CPU, memory, latency, error rate, traffic, availability, and error-log bursts on checkout-service in overlapping five-minute windows. Independent detectors, one clock.

Observed vs baseline

Every row carries both. If baseline is 125ms and observed is 1900ms, that is the claim. Compose is not allowed to say “slightly elevated.”

Scope

service vs global. Most hits are service-scoped. Global is reserved for signals that have no owner in the graph — treat those as last.

Severity score

A detector-local number used by correlation weights. It is not an SLO burn. Do not paste it into a customer email.

Empty ledger

After a healthy-baseline run this table should be empty. That is the control. If it is not empty, the detectors are too hungry.

Gates in YAML

Thresholds live in configs/default.yaml under anomaly_detection. A quiet CPU series does not suppress an error-rate spike.

FamilySignalGate
error_rate_spikeHTTP 5xx / error_ratez ≥ 2.5 · MAD × 2.5 · Δ ≥ 15%
latency_spikep95 / request_latency_msz ≥ 2.5 · MAD × 2.5 · Δ ≥ 20%
cpu_anomalycpu_usage / cpu_percentz ≥ 2.5 · lookback 20 buckets
memory_anomalymemory_usage_mbz ≥ 2.5 · relative change 15%
traffic_droprps / throughputz ≥ 2.2 · MAD × 2.2
service_unavailabilityupstream_failure / unavailablez ≥ 2.0 · higher severity weight
error_log_burstERROR log countburst vs baseline · min support 3
critical_log_burstCRITICAL log countseverity weight 1.2 in correlation