anomalies
last poll 2026-10-11 19:51:54 UTC · ago · polls every 5m 0s
showing master only — show the whole fleet
no anomalies on this host
0 fields analyzed in the latest detector pass — the detector's most recent pass over each host in scope — the pass that judged the rows the line above is dated by, not a running total. It works a fixed grid, so most poll cycles have no new row for it and leave this standing; the tracked count below is what the sidecars hold in all
0 fields awaiting a verdict — fields the detector could not judge in that same pass: too little history for the daily model, fewer than two same-time-of-day shifts, a non-finite model, or a model with no scale at all — expectation, σ and day spread every one of them zero, which leaves nothing for a departure to be material against; an otherwise flat model is answerable and detects material departures
current rule: an anomaly opens after 3 consecutive 30-minute rows more than 5.9σ out, more than 25% off the expectation and more than 50% of the field's own day spread (its 5th-to-95th-percentile range over the preceding day, applied once at least 21 rows of that day are known) — the σ comes from at most 6 same-time-of-day shifts over the previous 6 days, pooling the known rows around each shift, and the bar widens on a thinner pool because a σ estimated from that few carries its own error (a flat finite pool is deterministic: a material departure is outside, unless the expectation and the day spread are flat at zero too, which leaves no scale to be material against) — and is then put to the same hour of the same weekday, which discards it when that hour routinely looks like this; a field with under 3 weeks of history has no weekly model to be put to, so it opens marked unconfirmed rather than being held back; it closes after 6 rows each back inside 4.0σ or under either effect floor — and that closing run of 6 rows is then put to the two halves of its own reference, split at the excursion's first row: a run nearer the level the reference learned DURING the excursion than the level before it is filed as a regime change rather than a recovery (detector method 2)
0 fields tracked since the first scan — cumulative across every scan ever run, unlike the two per-cycle lines above: every field the detector has latched, every excursion the weekly gate has discarded as seasonally normal, and every anomaly closed because the reference learned its level