Domain scoring and severity benchmarking in Anomaly Dashboard

Different cases considered for domain scoring and severity benchmarking in Anomaly Dashboard.

The following methodologies (in the same order specified below) are usually considered for the final score determination:


1. Another attribute of the same monitor detected as anomalous

It facilitates the increase of the overall anomaly score if an anomaly is detected with another attribute of the same monitor.

2. Dependent monitors detected with anomaly

Severity of the anomaly detected in a monitor can be increased if any of the monitors, which are dependent on it or monitor for which it is dependent has anomalies. For example, a URL monitor has a Server monitor as a dependent monitor. If URL monitor has 'Response time' anomaly and at the same time interval, a Server monitor also has 'CPU Usage anomaly', then the score and severity of anomaly will be increased. It can also be inferred that Response time spike is due to spike in CPU usage of underlying server.

These dependent monitors are associated during the additon of the monitor. 

3. Parent/child monitors are anomalous

Dependency scoring can also be done using Parent/Child dependency. For example, if an underlying plugin monitor has any anomaly, it will also affect the health of the parent server monitor. So, whenever an anomaly occurs in a monitor, we will check if there exists any child monitor of it. If the child monitor also has anomaly, score will be increased and we can infer that the anomaly in parent might be caused due to child monitor's anomaly.

4. Monitors, grouped under the same Monitor Group detected as anomalous

If any of the monitors in the monitor groups (to which current monitor with anomaly belongs to) have anomalies in last half an hour, then it'll increase the overall score. There are two types to add the score:

  • Infrastructure monitors:
    For infrastructure monitors, if there's an anomaly in the same monitor group, it increases the overall score.

  • Non-infrastructure monitors:
    If non-infrastructure monitors have anomaly in same monitor group, it increases  the score.

5. Other monitor with the same Tags (user defined tags) has anomaly

If monitors with same tags have anomaly, it increases the score for ingrastructure as well as non-infrastructure monitors.

6. Monitors with the same Fully Qualified Domain Name (FQDN) has anomaly

Monitors having same domain name can also be grouped together for Anomaly scoring. In most of the cases, monitors with same domain are affected or have anomalies at the same period. 

7. Monitors with the same Server name

Monitors having same server name can be grouped together for Anomaly scoring.

8. Same Monitor Type

If none of the above cases are satisfied, scoring is handled based on anomalies detected in other monitors of the similar monitor type.


    • Related Articles

    • How to enable or disable anomaly alerts

      Understanding alerts In Site24x7, there are two different types of alerts in anomaly detection: Status change alert: Triggered when there is a change in the monitor status, such as Trouble, Critical, or Down. Anomaly alert: Triggered when irregular ...

    • Troubleshooting steps for No anomaly triggered

      Why are anomaly alerts not triggered? If you are not receiving anomaly alerts, it means that the model was not able to recognize a behavior as an anomaly. Site24x7's AI-powered Zia framework is the underlying mechanism of anomaly detection. The ML ...

    • Understanding different performance variables and calculations used in Site24x7 Reports

      Site24x7 monitors your critical resources round-the-clock and presents those stats and trends holistically to you via comprehensive reports. This article intends to throw more insight into the various availability and performance parameters captured ...

    • Domain configurations for location server IPs

      Site24x7 provides the option to whitelist domain/IP addresses of the global location servers to overcome the firewall restrictions at the user end. Now, you can whitelist the domains restricted to a geographic region. For example, when you whitelist ...

    • How to retrieve logs from different Site24x7 monitors

      The log location varies with different agents and monitors. View a consolidated list here: Site24x7 Server Monitoring agent Monitor or module OS Directory, path, or command Detailed reference Server Monitoring Agent Windows Installation directory > ...