- Newest
- Most votes
- Most comments
Hi Dave,
CloudWatch anomaly detection might take up to two weeks to fully train the model. The more data is available the earlier the model will be ready. Given the daily period and only 9 days of past data, it might take a few more days until the detection model is ready. Please see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html#CloudWatch_Anomaly_Detection_Algorithm for more information
When you enable anomaly detection for a metric, CloudWatch applies machine learning algorithms to the metric's past data to create a model of the metric's expected values. The model assesses both trends and hourly, daily, and weekly patterns of the metric. The algorithm trains on up to two weeks of metric data, but you can enable anomaly detection on a metric even if the metric does not have a full two weeks of data.
Relevant content
- Accepted Answerasked 2 years ago
- asked 6 months ago
- AWS OFFICIALUpdated 15 days ago
- AWS OFFICIALUpdated a month ago
- AWS OFFICIALUpdated 2 months ago
- AWS OFFICIALUpdated 9 months ago
After 14 days the model training seemed to finalise and I started getting alerts. However, the band is suddenly super narrow, not like was illustrated before. As a result, the alarms are going off, seemingly multiple times per day. Not sure if this is still a case of waiting longer.
I tried editing the model and increating the anomaly detection threshold (was 1.1, tried increasing to 2 as a preview) but it still thinks the band is very narrow. At present I get around 1100 invocations per 24 hours, and I'd ideally like an alert if there is more than a +/- 5-10% deviation, as that might be indicative of a problem with the external source.
In the screenshot, you can see that the data source provides fairly consistent data day-to-day, and that prior to the training completion the illustrated spread was actually far wider than expected. Now the spread is actually around ideal, but is actually set higher than the trend, so its causing an alarm: