Anomaly Detection Visualization

Overview

FEATURE AVAILABILITY: LogicMonitor Enterprise

Anomaly detection is the identification of data that does not conform to expected (or usual) patterns. LogicMonitor employs advanced machine learning algorithms to establish expected data patterns for datapoints so that it can then visually identify data that falls outside of these patterns. This provides another avenue of insight into resource behavior, allowing users to potentially catch issues before they escalate into more severe events.

LogicMonitor uses the mean absolute deviation (MAD), a standard statistical model, to identify anomalies. Datapoints with a 3.5 score from the MAD, which is calculated using the three days of data immediately prior to the current graph view, are determined to be anomalies.

Note: Anomaly detection can also be used to reduce alert noise. For more information, see Enabling Dynamic Thresholds for Datapoints.

Anomaly Detection Graphs

Similar to data forecasting, anomaly visualization is available from any graph in the LogicMonitor interface, regardless of whether it is being viewed from the Graphs tab, Alerts page/tab, or dashboard.

To display the anomaly detection version of a graph, click the dropdown arrow in the upper right corner of the graph and select “Anomaly Detection” from the dropdown menu that appears. A dedicated anomaly detection graph opens, with anomalies highlighted in red.

Note: Anomaly detection graphs can only visualize one datapoint or instance at a time. If your graph charts the signals of multiple datapoints (or multiple instances per datapoint), use the legend selections in the bottom left corner of the graph window to toggle between datapoints/instances.

As discussed in the following sections, there are several unique tools available on an anomaly detection graph that you can use to derive additional context from the data presented.

Expected Range

When enabled, the Expected Range option shades the area of the graph in which datapoint values are expected to fall. The expected range is based on the three days of historical data immediately preceding the start of the graph’s time range; this historical data is fed into the anomaly detection algorithm to generate a forecast that is then projected onto the current time range.

Offsets

When enabled, an offset adds a historical signal to the graph to support a quick comparison with the current signal. LogicMonitor offers three offsets, allowing you to display signals that shift back in time by 24 hours, one week, or 30 days. For example, if you are analyzing a point in the graph that occurred on Wednesday at 3:09 p.m., the one-week offset point would represent 3:09 p.m. on Wednesday of the previous week.

Show Alert Threshold

The Show Alert Threshold option is available if a static threshold containing the “value” alert operator (e.g. the current datapoint value is directly compared to the threshold value) is set for a respective datapoint. When this option is enabled, all thresholds associated with the datapoint are overlaid across the graph. For more information on setting static datapoint thresholds, see Datapoint Overview.

This anomaly detection graph indicates that anomalous conditions existed for a little over an hour over the 24-hour duration depicted. It features the light blue expected range overlay, alert threshold markers, and a one-week offset comparison (represented by the green line).

Time Range

By default, an anomaly detection graph preserves the time range that was set for its originating graph. This time range can be customized to the minute using the From and To fields.

Ops Notes

The ability to add Ops Notes isn’t unique to this graph version, but it’s worth noting that users retain the ability to view and set Ops Notes from anomaly detection graphs. Ops Notes are time-stamped annotations that add context to graph data, notably context that serves to correlate anomalies in graph data with other events in your environment. For more information on Ops Notes, see Using Ops Notes.