enable `ml_1min_node_ar` as a default alert (#14687)

Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>

1 files changed, 17 insertions, 15 deletions

diff --git a/health/health.d/ml.conf b/health/health.d/ml.conf
index 6836ce7b1a..94d6303ed8 100644
--- a/health/health.d/ml.conf
+++ b/health/health.d/ml.conf
@@ -3,23 +3,25 @@
 # native anomaly detection here: 
 # https://learn.netdata.cloud/docs/agent/ml#anomaly-bit---100--anomalous-0--normal
 
-# examples below are commented, you would need to uncomment and adjust as desired to enable them.
+# some examples below are commented, you would need to uncomment and adjust as desired to enable them.
 
-# node level anomaly rate example
+# node level anomaly rate
 # https://learn.netdata.cloud/docs/agent/ml#node-anomaly-rate
-# if node level anomaly rate is between 1-5% then warning (pick your own threshold that works best via tial and error).
-# if node level anomaly rate is above 5% then critical (pick your own threshold that works best via tial and error).
-# template: ml_1min_node_ar
-#       on: anomaly_detection.anomaly_rate
-#       os: linux
-#    hosts: *
-#   lookup: average -1m foreach anomaly_rate
-#     calc: $this
-#    units: %
-#    every: 30s
-#     warn: $this > (($status >= $WARNING)  ? (1) : (5))
-#     crit: $this > (($status == $CRITICAL) ? (5) : (100))
-#     info: rolling 1min node level anomaly rate
+# if node level anomaly rate is above 1% then warning (pick your own threshold that works best via trial and error).
+ template: ml_1min_node_ar
+       on: anomaly_detection.anomaly_rate
+    class: Workload
+     type: System
+component: ML
+       os: *
+    hosts: *
+   lookup: average -1m of anomaly_rate
+     calc: $this
+    units: %
+    every: 30s
+     warn: $this > 1
+     info: rolling 1min node level anomaly rate
+       to: silent
 
 # alert per dimension example
 # if anomaly rate is between 5-20% then warning (pick your own threshold that works best via tial and error).