Skip to content

Turn on anomaly detection

You will learn how to turn on anomaly detection for a stream, choose how often and how strictly it scans, and keep noisy services or metrics out of it.

Anomaly detection compares the stream with its own history and lists anything unusual on Findings. Read Patterns and findings for how it decides.

Before you start

  1. Select a stream in the sidebar.
  2. Have the Settings stream role or higher. People with Query access can read findings but cannot change detection.
  3. Ingest events with a log message, or HTTP request and job events. Open Patterns to confirm patterns are appearing.

Nothing leaves Cordo when you turn detection on. Findings stay in the app until you add a Findings monitor.

1. Turn it on

From Findings:

  1. Open Findings. When detection is off, the page shows Anomaly detection is off for this stream.
  2. Click Turn on anomaly detection to use the defaults, or Adjust settings first to open the stream's settings.

From Streams:

  1. Open Streams and edit the stream.
  2. In the Anomaly detection section, check Turn on anomaly detection.
  3. Choose the settings below, then click Save changes.

You can also turn it on when you create a stream.

2. Choose the settings

Setting Options Default What it does
Scan every 15 minutes, 1 hour 1 hour How often Cordo scans, and how long each compared window is.
Sensitivity Low, Medium, High Medium How far from usual a change must be. High finds more, including smaller changes.
Minimum events 1 to 1,000,000 20 Events a pattern needs in a scan window before spikes and drops count.
Ignore services Up to 50 service names None Events from these services are left out of the scan, so they raise no findings.

Start with the defaults. Raise Minimum events or lower Sensitivity if quiet patterns produce noise; use a 15-minute scan when you want to hear about changes sooner.

Ignored services' events don't count towards pattern, error rate, or volume findings — a pattern shared with other services is judged on the other services' events only. Recorded metrics are still scanned in full; turn off Anomaly scan on a metric to leave it out. To pause findings for a while instead, mute a pattern, service, or kind.

3. Check that it is scanning

Findings shows the scan status under the page header, for example Scans every hour · last scan 12 minutes ago · next in 48 minutes. Click Settings beside it to change the settings.

  • The first scan runs within a few minutes of turning detection on.
  • If a scan fails or is skipped, the status says why. The last scan was skipped because events were still being processed. means ingest was behind; the next scan catches up.
  • While the stream is in its learning period, a banner reads Learning this stream's normal behaviour until …. Findings appear but won't trigger alerts yet.

When nothing is unusual, the Open tab reads Nothing unusual in the last 7 days with the time of the last scan.

4. Choose which metrics are scanned

Recorded metrics on the stream are scanned too, one finding per unusual series. Each metric has its own switch:

  1. Open Metrics and click edit on the metric.
  2. Check or clear Anomaly scan.
  3. Save.

The Metrics list shows anomaly scan off for metrics you opt out. Cordo checks up to 50 series per metric each scan, busiest first.

Turn it off

Edit the stream and clear Turn on anomaly detection. Scans stop and no new findings are raised. Existing findings stay on Findings; open ones are not resolved while detection is off, so dismiss any you no longer need.

Next