Yup, such things are some of why, when I did work in anomaly detection, I wanted it to be multi-dimensional. What you observed is the same song, second verse o

Yup, such things are some of why, when I did work in anomaly detection, I wanted it to be multi-dimensional. What you observed is the same song, second verse of: There was a cluster doing transaction processing. One of the computers in the cluster got a little sick and was throwing all its incoming transactions into the bit bucket. The load leveling for the cluster sent the next transaction to the least busy computer in the cluster, and the sick computer, not doing any real work, was usually the least busy so got nearly all the incoming transactions. So, really the one sick computer was throwing away nearly all the incoming transactions of the whole cluster, made the whole cluster look sick. So, sure, some anomaly detection that takes as its input data, say, the CPU busy of each of the computers in the cluster should see that the one sick computer was comparatively low on CPU busy, call that an anomaly, raise an alarm, and let diagnosis begin. Sure, if do have such an anomaly detector, very much want good control over false alarm rate. So, can see what I posted five days ago (gee, suddenly anomaly detection is getting popular on HN?) in https://news.ycombinator.com/item?id=14119753 https://news.ycombinator.com/item?id=14119753 and https://news.ycombinator.com/user?id=graycat https://news.ycombinator.com/user?id=graycat