Hawkular - Advanced Behaviour Detection with Nelson Rules

Modeling Conditions

Hawkular Alerting offers several types of Conditions for defining Triggers. Most of the Conditions deal with numeric data but String, Availability and Event data are also supported.

Modeling scenarios for detecting behaviours is highly dependent on the nature of the Domain being represented. The Domain may only require simple numeric threshold conditions to efficiently detect unexpected situations.

In other domains, it can be non-trivial to identify unusual metric variations that may lead to a problem. Simple thresholds are not expressive enough to detect metric patterns or trends that can identify potential problems.

Nelson Rules

Hawkular Alerting supports Conditions based on Nelson Rules to enable advanced detection on Numeric metrics.

These rules are based on the mean and the standard deviation of the samples and offer additional techniques for modeling complex scenarios.

For example,

...
"trigger":{
   "id": "nelson-rule-trigger",
   "name": "Nelson Rule Trigger",
   "description": "An example Trigger that uses Nelson Rules Conditions.",
   "enabled": true,
   "actions":[]
},
"conditions":[
   {
      "type": "NELSON", (1)
      "dataId": "metric-data-id",
      "activeRules": ["Rule1","Rule2"], (2)
      "sampleSize": 75 (3)
   }
]
...

Mark this Condition as a NelsonRule
Define the Nelson Rules to activate (Rule1, Rule2, …, Rule8) for metric-data-id (all rules are activated by default)
Define the sampleSize (by default this value is set to 50)

Each rule represents a specific pattern as described below:

Rule 1

One sample is grossly out of control.

Rule 2

Some prolonged error has been detected.

Rule 3

An unusual trend has been detected.

Rule 4

The oscillation of a metric is beyond an expected amount of noise.

Note that the rule is concerned with directionality only. The position of the mean and the size of the standard deviation have no bearing.

Rule 5

There is a medium tendency for samples to be mediumly out of control.

The side of the mean for the third point is unspecified.

Rule 6

There is a strong tendency for samples to be out of control.

Rule 7

A greater variation would be expected.

Rule 8

Jumping from above to below whilst missing the first standard deviation band is rarely random.

Conclusion

Applying Nelson Rules in our scenario can help to detect potential "out of control" situations.

But as discussed, modeling scenarios are highly dependent of the nature of the Domain; applying Nelson Rules is a useful tool to help identify a problem. Although, the alerts are predictive and a Domain’s Analyst may need to evaluate the quality of the model.