Observability scan — at1 observe

at1 observe scores every event by its conditional description length against a dictionary of normal traffic: normal events extend the dictionary cheaply, while a novel log template or an out-of-distribution value costs many extra bits. It's a label-free anomaly detector for logs, metrics and netflow — no rules, no signatures, no training— and the signal is essentially free because you were compressing anyway.

Use it

# 1) learn a model of normal from a sample of your stream -> a small local baseline file
at1 observe baseline normal.log -o normal.at1obs

# 2) scan live traffic against it
at1 observe scan live.log --baseline normal.at1obs
#   scanned 42 events, 2 anomaly(ies)
#   [1.400]  ERROR segfault at 0xdeadbeef in mod xyzzy
# exit code 2 when anomalies are found -> drop into a CI step or a cron alert

What it catches

  • Content surprise — novel error templates, out-of-distribution field values, injected or garbled records, format drift; anything that doesn't compress like normal.
  • Multi-scale scoring — scores the whole line and each token, so a single anomalous field isn't diluted across an otherwise-normal event.
  • CI-ready — exit code 2 flags stream anomalies out of the box for a CI step or an alert.

Honest scope

On the reference battery the detector separates normal from anomaly at AUC ≥ 0.90 with ≥ 0.75 recall at a threshold calibrated for ≤ 2.5% false positives. The dictionary is static (no concept-drift tracking yet), and it finds contentsurprise, not rate surprise: frequency/burst anomalies need a rate channel this doesn't cover.

See the marketing overview at AT-1 Observe. The same idea on sensor signals is Predictive Diagnostics.

← CLI reference