From 31a46c5412df7d093267364fdf32cef368b1b939 Mon Sep 17 00:00:00 2001
From: Andrew Maguire <andrewm4894@gmail.com>
Date: Mon, 3 Oct 2022 16:47:36 +0200
Subject: add node level AR based example (#13684)

add node level anomaly rate based example
---
 health/health.d/ml.conf | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

(limited to 'health')

diff --git a/health/health.d/ml.conf b/health/health.d/ml.conf
index 9bcc81e76b..6836ce7b1a 100644
--- a/health/health.d/ml.conf
+++ b/health/health.d/ml.conf
@@ -1,10 +1,26 @@
 # below are some examples of using the `anomaly-bit` option to define alerts based on anomaly 
 # rates as opposed to raw metric values. You can read more about the anomaly-bit and Netdata's 
 # native anomaly detection here: 
-# https://learn.netdata.cloud/docs/configure/machine-learning#anomaly-bit---100--anomalous-0--normal
+# https://learn.netdata.cloud/docs/agent/ml#anomaly-bit---100--anomalous-0--normal
 
 # examples below are commented, you would need to uncomment and adjust as desired to enable them.
 
+# node level anomaly rate example
+# https://learn.netdata.cloud/docs/agent/ml#node-anomaly-rate
+# if node level anomaly rate is between 1-5% then warning (pick your own threshold that works best via tial and error).
+# if node level anomaly rate is above 5% then critical (pick your own threshold that works best via tial and error).
+# template: ml_1min_node_ar
+#       on: anomaly_detection.anomaly_rate
+#       os: linux
+#    hosts: *
+#   lookup: average -1m foreach anomaly_rate
+#     calc: $this
+#    units: %
+#    every: 30s
+#     warn: $this > (($status >= $WARNING)  ? (1) : (5))
+#     crit: $this > (($status == $CRITICAL) ? (5) : (100))
+#     info: rolling 1min node level anomaly rate
+
 # alert per dimension example
 # if anomaly rate is between 5-20% then warning (pick your own threshold that works best via tial and error).
 # if anomaly rate is above 20% then critical (pick your own threshold that works best via tial and error).
@@ -33,4 +49,5 @@
 #    every: 30s
 #     warn: $this > (($status >= $WARNING)  ? (5) : (20))
 #     crit: $this > (($status == $CRITICAL) ? (20) : (100))
-#     info: rolling 5min anomaly rate for system.cpu chart
\ No newline at end of file
+#     info: rolling 5min anomaly rate for system.cpu chart
+
-- 
cgit v1.2.3