node-bell's Introduction

Bell

Realtime anomalies detection based on statsd, for periodic time series.

Latest version: v0.1.6

Requirements

node.js 0.11.x
ssdb 1.6.8.8+
beanstalkd
statsd

Installation

npm install node-bell -g

then add node-bell to statsd's backends in statsd's config.js:

{
, backends: ["node-bell"]
}

Quick Start

Start statsd & ssdb & beanstalkd.
Generate sample configuration and edit it, default res/configs.toml:
```
$ bell -s
$ mv sample.configs.toml configs.toml
$ vi configs.toml
```

Start listener & analyzers (optional: webapp).

bell analyzer -c configs.toml
bell listener -c configs.toml
bell webapp -c configs.toml

You can view site on 0.0.0.0:8989.

Services

listener: receives incoming metrics from statsd, then put them to job queue.
analyzer(s): get job from job queue, and then analyze if current metric an anomaly or not.
webapp: visualizes analyzation result on web.

Events & Hooks

Hook modules are Node.js modules that listen for events from node-bell. Each hook module shoule export the following initialization function:

init(configs, analyzer, log)

Events currently available:

Event 'anomaly detected'

Parameters: (metric, multiples)

Emitted when an anomaly was detected.

Built-in hook module (and sample hook): hooks.

Look Inside

Algorithm

3-sigma or called 68-95-99.7 rule, reference

Storage

Analyzers store metrics in ssdb, using zset, here is storage format for a single time series:

key       |  score
--------------------------------------
timestamp | value:is_anomaly:timestamp

Data Flow

 [statsd]
    |
    v        send to queue
[listener] -----------------> [beanstalkd]
                                  |
                                  | reserve
            history metrics       v       record anomalies
            ---------------> [analyzers] ----------------
            |                     |                     |
            |                     | put to ssdb         |
            |                     v                     |
            ------------------- [ssdb] <-----------------
                                  |
                                  |
                                  v
                               [webapp]