Yes. I mean anomaly detection based on identifying what’s unusual behavior not just typical. We have computers to use their CPUs, RAM, and disk. Using it isn’t

Yes. I mean anomaly detection based on identifying what’s unusual behavior not just typical. We have computers to use their CPUs, RAM, and disk. Using it isn’t weird. Detecting actual unwanted or dangerous behavior is bad. For bonus points auto-remediate it (eg take the node offline so the workload moves to another node) and alert when your overall capacity of your service is potentially going to be impacted or is near a limit, for some version of near. Being human I much prefer “you have hours to fix this” than “I’m broken fix me”. RED, Golden Signals, etc. there are plenty of nice frameworks for how to think about utilization and performance of your service that you can use to manage capacity and health. CPU at 90 is not one of them. As soon as someone suggests it I always ask for how long? On which processes? on which boxes? What is the “perfect” CPU utilization? Then make them think about why we wouldn’t want to use the resources we paid for.