Anomaly Alert Statuses

A ThingWatcher instance moves through several statuses as it works its way through the corresponding phases. These statuses are described below.

When a ThingWatcher instance has been successfully initialized, it is ready to receive data from an edge device so it can prepare to monitor a data stream for anomalies.

If the ThingWatcher instance is not created successfully, a status of Initialization Failed will display. This type of failure can occur if the external Training or Results services are not properly installed and running, or when the services are not defined in the Alert Processing Subsystem Configuration. To identify the specific error, see the Application Log.

In the Calibrating status, the ThingWatcher instance collects the data necessary to build an anomaly model and generate a set of validation data. The instance will remain in this status until the proper amount of data has been collected to begin the model building process. During the data collection phase, the sampling rate is imputed and any gaps in the data are interpolated so that there are no missing values.

When a sufficient amount of data has been collected, the ThingWatcher instance enters the Training status. During this phase, an external Training service builds an anomaly model that will be used during Monitoring.

In the Buffering status, the ThingWatcher is no longer calibrating, or training. It has a few tasks to complete during this phase:

• Use the validation data, collected during the Calibrating phase, to build an expected distribution of values that will be used during Monitoring to evaluate new data points.

• Collect enough data to rebuild the operating lookback window in order to effectively monitor streaming data.

The lookback window is the last X number of data values received, (a number defined by the anomaly model created during Training). For example, if the model defines a lookback window of 16 values, the ThingWatcher uses the previous 16 values in the historical data to predict the next value. If any of the previous 16 values are missing, the ThingWatcher must rebuild its lookback window of values in order to effectively monitor the data stream.

There are two scenarios where the system might enter the Buffering state.

1. When Training is completed, the ThingWatcher must collect enough data to complete the lookback window, as defined by the model, before it can start monitoring. Therefore, a brief period of Buffering will always occur immediately following the Training status.

2. If a time gap occurs, while in the Monitoring status, between the previous and current data points, the lookback buffer will be cleared. The ThingWatcher will re-enter the Buffering state and will remain in this state until the lookback window buffer is completely filled.

In the Monitoring status, the ThingWatcher instance is evaluating the streaming data for anomalies. The Monitoring status can be considered the normal operating state of the ThingWatcher once Calibrating and Training have completed.

The Failed status indicates that the ThingWatcher instance is unable to continue its Calibrating, Training, Buffering, or Monitoring procedures. The following scenarios can cause the system to enter the Failed status:

• Either of the external components, the Training service or the Results service, is not configured correctly or is not running.