Log Anomaly Detection Reset

In LM Logs, you must regularly reset the log anomaly profile for accurate anomaly detection by maintaining a relevant baseline. Without a reset, an anomaly is flagged only once for that device, potentially missing new behaviors or significant log pattern changes. Regular resets improve troubleshooting and keep anomaly detection relevant. A structured reset approach ensures meaningful insights, reduced alert fatigue, and accurate anomaly detection in evolving IT environments. 

The following list describes the key benefits of resetting a log anomaly profile:

• Detects new log behaviors and changes in both the sandbox and production environments.
• Validates pipeline alerts for anomalies or “never-before-seen” conditions.
• Resets logs after a major outage to remove outdated anomalies.
• Transitions smoothly from trial to production with a clean slate.
• Maintains accuracy with user initiated periodic resets (monthly, quarterly, or annually).
• Adapts to new applications, system changes, or infrastructure migrations.
• Ensures compliance during audits by refreshing anomaly baselines to detect new threats.

Log Anomaly Detection Reset Limitations

You can reset the anomaly detection feature multiple times. The following limits apply within each 24-hour period:

• Portal Level—You can reset anomalies once every 24 hours. The reset interval starts immediately after the reset is performed.
• Resource or Resource Group Level—You can reset anomalies up to three times within a 24-hour period. The reset interval starts after the third reset.

If you try to reset anomalies during the reset interval, a message displays the time remaining until the next reset.
For example, if you perform a portal level reset at 1:00 PM, the feature is unavailable until 1:00 PM the next day. If you try again at 1:30 PM, the following message is displayed:
“Please try again after 23 hours and 30 minutes.” 

Requirements for Resetting Log Anomaly Detection

To reset the log anomaly profile, you must have Manage Resource permissions on the folder or root directory. This requirement applies to portal, resource, and resource group resets.

Resetting Log Anomaly Detection at Resource Level

1. In the LogicMonitor portal, go to Resource Tree.
2. Select the desired resource and select the Logs tab.
3. Select the More  menu, then select Reset anomaly detection. A message confirming your selection is displayed.
   

4. Select Reset anomaly detection to confirm reset of the selected resource.
   
   A success message appears confirming that log anomaly detection has been reset.
   The system resets anomaly detection within a few seconds, but it may take up to a minute for anomalies to appear.

Resetting Log Anomaly Detection at Resource Group Level

1. In the Resource Tree, select the desired resource group.
2. Select the Logs tab, select the More  menu, and select Reset log anomaly detection.
3. In the confirmation dialog box, select Reset anomaly detection.
   
   A success message appears confirming that log anomaly detection has been reset. 
   The success message may take up to one minute to appear, and anomalies can take up to 15 minutes to trigger, depending on the number of resources in the group.

Resetting Log Anomaly Detection at Portal Level

1. In LogicMonitor, go to the Resource Tree, select the root folder.
2. Select the More  menu, and select Reset log anomaly detection.
   
3. In the confirmation dialog box, select Reset anomaly detection.
   
   A success message appears confirming that log anomaly detection has been reset.
   Portal-level anomaly detection resets can take longer. Reset time depends on the number of resources sending logs.