Volume Anomaly

Example alert

Exact wording varies — the detector generates titles from the anomaly it finds. This is representative of what an alert looks like when it fires.

How it works

Computes per-hour-of-day, per-day-of-week rolling statistics (mean, stddev, percentiles) over 7 days. Each minute's volume is scored as a z-score against the matching seasonal baseline. Spikes, drops, and flatlines each have independent thresholds. Learning period: 7 days.

Availability

Runs on these tiers:

Related detectors

• Silence Detection

  Catches services that stop logging when they normally log every N seconds. The most dangerous failure mode: no errors, just absence.

• Outlier Detection

  Multi-dimensional outliers in log feature space. Catches subtle anomalies that single-axis thresholds miss.

• Numeric Field Anomaly

  Discovers the numeric fields your logs carry — payment amounts, cache hit rates, queue depths, inference scores — and flags when one drifts from its baseline.

• Post-Change Regression

  Checks whether a deploy, config change or scale event actually made things worse, by comparing the window after the change against the matched window before it — per service.

• Error Growth Forecast

  Spots an error signature whose arrival rate is climbing and projects when it reaches a volume that matters — as a time range, before the incident, not after.