Skip to content

Anomaly detection service

The anomaly detection service employs an advanced neural network algorithm to identify data points of key metrics that are outside a metric's normal range of values. The service uses deep historical data and frequent model training to deliver accurate, precise, and near real-time results.

The following features use results from the anomaly detection service:

  • The Anomalies tile automatically highlights anomalous entities.
  • Smart View pages display anomalous metrics on the primary entity and on related entities.
  • The action service supports anomaly triggers.

How it works

When the service finds enough historical data for a key metric, it starts training a model of the metric. When a new data point arrives, the service compares the data point with the model and then scores it with a value between 0 and 1. A score of 0.0 is 100% normal, and 1.0 is 100% anomalous. Perhaps unintuitively, almost all scores have to be greater than 0.99 to be considered anomalous.

Key metrics

Key metrics are the most important metrics for assessing entity health, as selected by Zenoss. You can customize this list.

Device class Data source Metric
/

Command

blkio_bytes_total
cpuacct_usage
memory_usage
/


SNMP


cpu_cpu
ifInOctets_ifInOctets
ifOutOctets_ifOutOctets
mem_mem
/AWS/EC2

CloudWatch

CPUUtilization_CPUUtilization
NetworkIn_NetworkIn
NetworkOut_NetworkOut
/CiscoUCS



XML API



adaptorVnicStats_bytesRx
adaptorVnicStats_bytesTx
etherFcoeInterfaceStats_bytesRx
etherFcoeInterfaceStats_bytesTx
etherRxStats_totalBytesRx
etherTxStats_totalBytes
etherTxStats_totalBytesTx
fcStats_bytesRx
fcStats_bytesTx
swSystemStats_memAvailable
/CloudFoundry Command app_usageCPUAverage
app_utilDisk
app_utilMemory
appinstance_usageCPU
appinstance_utilDisk
appinstance_utilMemory
/CloudStack Command cloudstack_cpuUsedPercent
cloudstack_memoryUsedPercent
cloudstack_networkRead
cloudstack_networkWrite
/GoogleCloudPlatform Stackdriver cpuUtilization_cpuUtilization
/Network/Check Point SNMP memActiveReal_memActiveReal
memActiveVirtual_memActiveVirtual
/Network/Check Point/Gaia SNMP memActiveReal_memActiveReal
memActiveVirtual_memActiveVirtual
/Network/Cisco



SNMP



cpmCPULoadAvg15min_cpmCPULoadAvg15min
cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
ifInErrors_ifInErrors
ifOutErrors_ifOutErrors
/Network/Cisco APIC APIC eqptEgrTotal_bytesRate
eqptIngrTotal_bytesRate
/Network/Cisco/6500 SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/ACE SNMP cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/ASA SNMP cpmCPUTotal5min_cpmCPUTotal5min
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/ASR SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/ASR/9000 SNMP cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/CSR SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/FWSM SNMP cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/IDS Command device_cpuUsage
device_memoryUsage
/Network/Cisco/MDS SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/Nexus SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/Nexus/1000V SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/Nexus/1010 SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Network/Cisco/Nexus/9000

NX-API

resources_cpu_state_kernel
resources_cpu_state_user
resources_memory_usage_used
/Network/Cisco/Nexus/VSG SNMP cpmCPUMemoryUsed_cpmCPUMemoryUsed
cpmCPUTotal5minRev_cpmCPUTotal5minRev
/Nutanix API stats_hypervisor_cpu_usage_pct
/OpenStack/Infrastructure Ceilometer cpuUtilization_cpuUtilization
/Server ApacheMonitor apache_cpuLoad
/Server



SNMP



memAvailReal_memAvailReal
memAvailSwap_memAvailSwap
ssCpuRawSystem_ssCpuRawSystem
ssCpuRawUser_ssCpuRawUser
ssCpuRawWait_ssCpuRawWait
/Server/Cmd






Command






cpu_ssCpuRawSystem
cpu_ssCpuRawUser
cpu_ssCpuRawWait
disk_usedBlocks
intf_ifInOctets
intf_ifOutOctets
mem_memAvailReal
mem_memAvailSwap
/Server/Darwin



SNMP



memAvailReal_memAvailReal
memAvailSwap_memAvailSwap
ssCpuRawWait_ssCpuRawWait
ssCpuSystem_ssCpuSystem
ssCpuUser_ssCpuUser
/Server/Linux



SNMP



memAvailReal_memAvailReal
memAvailSwap_memAvailSwap
ssCpuRawWait_ssCpuRawWait
ssCpuSystem_ssCpuSystem
ssCpuUser_ssCpuUser
/Server/Linux/Dell



SNMP



memAvailReal_memAvailReal
memAvailSwap_memAvailSwap
ssCpuRawWait_ssCpuRawWait
ssCpuSystem_ssCpuSystem
ssCpuUser_ssCpuUser
/Server/Microsoft

Perfmon

DiskReadTime_DiskReadTime
DiskWriteTime_DiskWriteTime
MemoryAvailableBytes_MemoryAvailableBytes
/Server/Solaris



SNMP



memAvailReal_memAvailReal
memAvailSwap_memAvailSwap
ssCpuRawWait_ssCpuRawWait
ssCpuSystem_ssCpuSystem
/Server/SSH/AIX Command cpu_ssCpuSystem
cpu_ssCpuUser
cpu_ssCpuWait
disk_usedBlocks
ethTraffic_Receive_Bytes
ethTraffic_Transmit_Bytes
intf_ifInErrors
intf_ifOutErrors
io_read
mem_percentMemUsed
/Server/SSH/Linux Command cpu_ssCpuStealPerCpu
cpu_ssCpuUsedPerCpu
disk_percentUsed
intf_ifInOctets
intf_ifOutOctets
mem_MemUsedPercent
mem_SwapFree
uptime_laLoadInt5
/Server/SSH/Solaris Command intf_ifInPackets
intf_ifOutPackets
/Server/Windows SNMP lDiskDiskReadBytesPerSec_lDiskDiskReadBytesPerSec
lDiskDiskWriteBytesPerSec_lDiskDiskWriteBytesPerSec
memoryAvailableKBytes_memoryAvailableKBytes
/Server/Windows/Dell SNMP cpuPercentProcessorTime_cpuPercentProcessorTime
/Storage/EMC EMC API Array_ReadIOs
Array_WriteIOs
DiskExtent_TotalIOs
FEPort_TotalIOs
StorageProcessorSystem_ReadIOs
StorageProcessorSystem_WriteIOs
StorageVolume_ReadIOs
StorageVolume_WriteIOs
/Storage/EMC/Isilon API cluster_cpu_sys_avg_value
cluster_cpu_user_avg_value
cluster_disk_bytes_in_rate_value
cluster_disk_bytes_out_rate_value
node_cpu_sys_avg_value
node_cpu_user_avg_value
node_disk_access_latency_avg_value
node_memory_used_value
/Storage/EMC/Isilon SNMP clusterCPUSystem_clusterCPUSystem
clusterCPUUser_clusterCPUUser
clusterIfsInBytes_clusterIfsInBytes
clusterIfsOutBytes_clusterIfsOutBytes
clusterNetworkInBytes_clusterNetworkInBytes
clusterNetworkOutBytes_clusterNetworkOutBytes
nodeCPUSystem_nodeCPUSystem
nodeCPUUser_nodeCPUUser
/Storage/EMC/XtremIO API stats_cpu
stats_cpu_usage
stats_iops
/Storage/EMC/XtremIO Snapshot stats_iops
/Storage/NetApp SNMP cpuBusy_cpuBusy
/Storage/NetApp/7-Mode SNMP cpuBusy_cpuBusy
/Storage/NetApp/7-Mode ZAPI lun_avg_read_latency
/Storage/NetApp/C-Mode ZAPI lun_avg_read_latency
/vSphere API cpuUsagemhz_cpuUsagemhz
memConsumed_memConsumed
memUsage_memUsage