skyline.boundary package

Submodules

skyline.boundary.agent module

skyline.boundary.boundary module

boundary.py

class Boundary(parent_pid)[source]

Bases: Thread

Boundary Thread

check_if_parent_is_alive()[source]

Self explanatory

unique_noHash(seq)[source]

Unique no hashed things

spin_process(i, boundary_metrics, added_at)[source]

Assign a bunch of metrics for a process to analyze.

run()[source]

Called when the process intializes.

skyline.boundary.boundary_alerters module

boundary_alerters

skyline_app_logfile = '/var/log/skyline/boundary.log'

Create any alerter you want here. The function is invoked from trigger_alert. 7 arguments will be passed in as strings: alerter, datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp

alert_smtp(datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]
alert_pagerduty(datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]
alert_hipchat(datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp)[source]
alert_syslog(datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]
alert_slack(datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]
alert_http(alerter, datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]

Called by trigger_alert() and sends and resend anomalies to a http endpoint.

alert_sms(datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]

Called by trigger_alert() and sends anomalies to a SMS endpoint.

trigger_alert(alerter, datapoint, metric_name, expiration_time, metric_trigger, algorithm, metric_timestamp, alert_threshold)[source]

skyline.boundary.boundary_algorithms module

boundary_no_mans_land()[source]

This is no man’s land. Do anything you want in here, as long as you return a boolean that determines whether the input timeseries is anomalous or not.

To add an algorithm, define it here, and add its name to settings.BOUNDARY_ALGORITHMS.

autoaggregate_ts(timeseries, autoaggregate_value)[source]

This is a utility function used to autoaggregate a timeseries. If a timeseries data set has 6 datapoints per minute but only one data value every minute then autoaggregate will aggregate every autoaggregate_value.

less_than(timeseries, metric_name, metric_expiration_time, metric_min_average, metric_min_average_seconds, metric_trigger)[source]

A timeseries is anomalous if the datapoint is less than metric_trigger

greater_than(timeseries, metric_name, metric_expiration_time, metric_min_average, metric_min_average_seconds, metric_trigger)[source]

A timeseries is anomalous if the datapoint is greater than metric_trigger

detect_drop_off_cliff(timeseries, metric_name, metric_expiration_time, metric_min_average, metric_min_average_seconds, metric_trigger)[source]

A timeseries is anomalous if the average of the last 10 datapoints is <trigger> times greater than the last data point AND if has not experienced frequent cliff drops in the last 10 datapoints. If the timeseries has experienced 2 or more datapoints of equal or less values in the last 10 or EXPIRATION_TIME datapoints or is less than a MIN_AVERAGE if set the algorithm determines the datapoint as NOT anomalous but normal. This algorithm is most suited to timeseries with most datapoints being > 100 (e.g high rate). The arbitrary <trigger> values become more noisy with lower value datapoints, but it still matches drops off cliffs.

run_selected_algorithm(timeseries, metric_name, metric_expiration_time, metric_min_average, metric_min_average_seconds, metric_trigger, alert_threshold, metric_alerters, autoaggregate, autoaggregate_value, algorithm)[source]

Filter timeseries and run selected algorithm.

Module contents