- - Anomaly Detection - Daria Karavaieva / Fred Navruzov * Recap: What is anomaly detection? * Recap: Why ML for anomaly detection? * Why VictoriaMetrics Anomaly Detection? * What’s new: Releases ** Release 1.6.0 (helm chart, docker img) with improved stability and integration * What’s new: AD & RCA Handbook * What’s coming: GUI * What’s coming: Presets (Node Exporter alerting)

2. VictoriaMetrics
Anomaly Detection
Fred Navruzov, Product Manager & Data Scientist
Daria Karavaieva, ML Engineer

3. Recap: What is anomaly detection?
Anomaly detection (AD hereinafter) refers to the task of identifying unusual
patterns that do not conform to expected behavior
Such “patterns” can introduce significant challenges and losses to your business,
if not properly and timely treated
Monitoring is a hard task, AD itself is a harder task, and AD for time series data -
metrics measured over time - is the hardest due to specific effects, like trends,
seasonality or different anomaly patterns

4. Recap: Why ML for anomaly detection?
● Challenges caused by time series nature of metrics, make simpler
approaches, like threshold-based alerting way less effective for
complex patterns (seasonality, collective anomalies, etc.)
● Manual handling of complex metrics doesn’t scale with the
growth of your data

5. Anomaly Detection @
VictoriaMetrics

6. Why VictoriaMetrics Anomaly Detection?
● A service that is simple to set up and to debug
● Integrates well with VictoriaMetrics observability ecosystem
● Collective & Contextual anomalies support (i.e. seasonality, metric interaction)
● Root Cause Analysis for faster and efficient metric incidents drilldown

7. Why VictoriaMetrics Anomaly Detection?
● Unified alerting rules on produced anomaly scores:
○ Fall within the range of 0 to 1 if the model considers the datapoint to follow a typical pattern
○ Exceed 1 if the datapoint is abnormal.

8. Release 1.6.0 (helm chart, docker img) with improved stability and integration
Release 1.7 is coming
What’s new: Releases

9. Blog post series on AD & RCA for the users to better understand & counter existing
caveats of anomaly detection in monitoring:
1. An Introduction & Glossary
2. Anomaly Types
3. Techniques and Models
4. Root Cause Analysis (coming soon)
Inspect a tag #anomaly-detection in our blog to stay tuned!
What’s new: AD & RCA Handbook

10. Set up, tweak
and evaluate
anomaly detection
easier and faster
to best accommodate
your data patterns!
What’s coming: GUI

11. What’s coming: Presets (Node Exporter alerting)
There is no one-fits-all solution in AD world. A better way is to tackle smaller scope
problems with presets and reactive alerting, not relying solely on static thresholding:
● Variability in your Workload: dynamic environments, often vary over time
● Increased rate of False Positives (alerting fatigue) and Negatives
● Scaling Challenges: resources may vary significantly across setups
● Seasonality and Time-of-Day Patterns: systems may exhibit different behaviors
at different times
● Maintenance Overhead: managing/updating static thresholds for a large number
of metrics is cumbersome

12. What’s coming: Presets (Node Exporter alerting)
Use cases:
- Detecting sudden shifts in metric patterns that don't necessarily breach predefined
static thresholds (crashes or overloads before they escalate)
- Accounting for seasonal variations in data - reducing false positives and improving
alert accuracy.
- Adapting to environmental changes such as modifications in resources or load
patterns. As these changes establish a 'new normal'
Simplify alerting by:
- Introducing a unified anomaly threshold.
- Establishing a consistent alerting interval, which reduces the need for manual
adjustments and human intervention in setting and maintaining alert thresholds.

13. What’s coming: Presets (Node Exporter alerting)
All together - the preset consists of
● The configuration files for AD models including predefined queries for Node
Exporter metrics.
● Alerting Rules to monitor anomaly scores generated by these models.
● Complementary Awesome Alerts defaults for alerts not addressed by the
anomaly detection.
● VM Anomaly Detection Grafana Dashboard (Node Exporter Healthcheck).

14. Try Anomaly Detection
Being a part of Enterprise offering, VM Anomaly Detection is
available for testing purposes - please request a trial license here or
contact us to give it a try!

15. Thank you!
Have questions left?
Contact Us