Volume Anomaly

Example alert

Exact wording varies — the detector generates titles from the anomaly it finds. This is representative of what an alert looks like when it fires.

How it works

Computes per-hour-of-day, per-day-of-week rolling statistics (mean, stddev, percentiles) over 7 days. Each minute's volume is scored as a z-score against the matching seasonal baseline. Spikes, drops, and flatlines each have independent thresholds. Learning period: 7 days.

Availability

Runs on these tiers:

Related detectors

• Silence Detection

  Catches services that stop logging when they normally log every N seconds. The most dangerous failure mode: no errors, just absence.

• Outlier Detection

  Multi-dimensional outliers in log feature space. Catches subtle anomalies that single-axis thresholds miss.

• Error Rate Anomaly

  Per-service error percentage anomalies vs baseline, with sustained-elevation guards so a single noisy minute doesn't fire and slow ramps still get caught.

• Recurring Pattern Detection

  Identifies log patterns that recur on a schedule — daily batch jobs, hourly cron runs, weekly reports — and flags when one fails to fire on its expected cadence.