CODE
CODE = 'anomaly.detected'
The finding code every anomaly is recorded under.
One measurement that departed from its own history.
Carries the numbers rather than a verdict, so an operator reading the finding can see what the baseline was and decide whether the departure is a fault or a busy afternoon. A detector that reported only "op rate is unusual" would be unactionable.
__construct(string $metric, string $label, float $observed, float $baseline, float $deviations, int $samples, string $unit = '') : mixed
Constructs an anomaly.
| string | $metric | Which measurement departed, such as "op_rate". |
| string | $label | The measurement's operator-facing name. |
| float | $observed | The latest observation. |
| float | $baseline | The median of the observations before it. |
| float | $deviations | How far the observation sits from the baseline, signed. |
| int | $samples | How many earlier observations the baseline came from. |
| string | $unit | What the numbers are counted in, for rendering. |
severity() : int
How severe this departure is.
A departure is a symptom and never a fault on its own, so it tops out at ERROR: a site that doubled its traffic is not corrupt, and a detector that could raise CRITICAL would put the repair ladder straight onto the quarantine rung for a busy Tuesday.
INFO, WARN or ERROR.