Merging upstream version 1.39.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

5 files changed, 97 insertions, 22 deletions

diff --git a/ml/Config.cc b/ml/Config.cc
index d451c602c..c5129c49d 100644
--- a/ml/Config.cc
+++ b/ml/Config.cc
@@ -28,7 +28,7 @@ void ml_config_load(ml_config_t *cfg) {
     unsigned max_train_samples = config_get_number(config_section_ml, "maximum num samples to train", 4 * 3600);
     unsigned min_train_samples = config_get_number(config_section_ml, "minimum num samples to train", 1 * 900);
     unsigned train_every = config_get_number(config_section_ml, "train every", 1 * 3600);
-    unsigned num_models_to_use = config_get_number(config_section_ml, "number of models per dimension", 1);
+    unsigned num_models_to_use = config_get_number(config_section_ml, "number of models per dimension", 2);
 
     unsigned diff_n = config_get_number(config_section_ml, "num samples to diff", 1);
     unsigned smooth_n = config_get_number(config_section_ml, "num samples to smooth", 3);
@@ -46,6 +46,9 @@ void ml_config_load(ml_config_t *cfg) {
     size_t num_training_threads = config_get_number(config_section_ml, "num training threads", 4);
     size_t flush_models_batch_size = config_get_number(config_section_ml, "flush models batch size", 128);
 
+    size_t suppression_window = config_get_number(config_section_ml, "dimension anomaly rate suppression window", 900);
+    size_t suppression_threshold = config_get_number(config_section_ml, "dimension anomaly rate suppression threshold", suppression_window / 2);
+
     bool enable_statistics_charts = config_get_boolean(config_section_ml, "enable statistics charts", true);
 
     /*
@@ -72,7 +75,10 @@ void ml_config_load(ml_config_t *cfg) {
     num_training_threads = clamp<size_t>(num_training_threads, 1, 128);
     flush_models_batch_size = clamp<size_t>(flush_models_batch_size, 8, 512);
 
-    /*
+    suppression_window = clamp<size_t>(suppression_window, 1, max_train_samples);
+    suppression_threshold = clamp<size_t>(suppression_threshold, 1, suppression_window);
+
+     /*
      * Validate
      */
 
@@ -121,5 +127,8 @@ void ml_config_load(ml_config_t *cfg) {
     cfg->num_training_threads = num_training_threads;
     cfg->flush_models_batch_size = flush_models_batch_size;
 
+    cfg->suppression_window = suppression_window;
+    cfg->suppression_threshold = suppression_threshold;
+
     cfg->enable_statistics_charts = enable_statistics_charts;
 }
diff --git a/ml/README.md b/ml/README.md
index ac7c7c013..60f38f22e 100644
--- a/ml/README.md
+++ b/ml/README.md
@@ -130,7 +130,7 @@ Below is a list of all the available configuration params and their default valu
 	# maximum num samples to train = 14400
 	# minimum num samples to train = 3600
 	# train every = 3600
-	# number of models per dimension = 1
+	# number of models per dimension = 2
 	# dbengine anomaly rate every = 30
 	# num samples to diff = 1
 	# num samples to smooth = 3
@@ -143,6 +143,8 @@ Below is a list of all the available configuration params and their default valu
 	# anomaly detection grouping duration = 300
 	# hosts to skip from training = !*
 	# charts to skip from training = netdata.*
+	# dimension anomaly rate suppression window = 900
+	# dimension anomaly rate suppression threshold = 450    
 ```
 
 ### Configuration Examples
@@ -187,7 +189,7 @@ This example assumes 3 child nodes [streaming](https://github.com/netdata/netdat
 - `maximum num samples to train`: (`3600`/`86400`) This is the maximum amount of time you would like to train each model on. For example, the default of `14400` trains on the preceding 4 hours of data, assuming an `update every` of 1 second.
 - `minimum num samples to train`: (`900`/`21600`) This is the minimum amount of data required to be able to train a model. For example, the default of `900` implies that once at least 15 minutes of data is available for training, a model is trained, otherwise it is skipped and checked again at the next training run.
 - `train every`: (`1800`/`21600`) This is how often each model will be retrained. For example, the default of `3600` means that each model is retrained every hour. Note: The training of all models is spread out across the `train every` period for efficiency, so in reality, it means that each model will be trained in a staggered manner within each `train every` period.
-- `number of models per dimension`: (`1`/`168`) This is the number of trained models that will be used for scoring. For example the default `number of models per dimension = 1` means that just the most recently trained model (covering up to the most recent `maximum num samples to train` of training data) for the dimension will be used to determine the corresponding anomaly bit. Alternatively, if you have `train every = 3600` and `number of models per dimension = 24` this means that netdata will store and use the last 24 trained models for each dimension when determining the anomaly bit, this means that for the latest feature vector in this configuration to be considered anomalous it would need to look anomalous across _all_ the models trained for that dimension in the last 24 hours. As such, increasing `number of models per dimension` may reduce some false positives since it will result in more models (covering a wider time frame of training) being used during scoring.
+- `number of models per dimension`: (`1`/`168`) This is the number of trained models that will be used for scoring. For example the default `number of models per dimension = 2` means that the two most recently trained models (covering up to the most recent `maximum num samples to train` of training data) for the dimension will be used to determine the corresponding anomaly bit. Alternatively, if you have `train every = 3600` and `number of models per dimension = 24` this means that netdata will store and use the last 24 trained models for each dimension when determining the anomaly bit, this means that for the latest feature vector in this configuration to be considered anomalous it would need to look anomalous across _all_ the models trained for that dimension in the last 24 hours. As such, increasing `number of models per dimension` may reduce some false positives since it will result in more models (covering a wider time frame of training) being used during scoring.
 - `dbengine anomaly rate every`: (`30`/`900`) This is how often netdata will aggregate all the anomaly bits into a single chart (`anomaly_detection.anomaly_rates`). The aggregation into a single chart allows enabling anomaly rate ranking over _all_ metrics with one API call as opposed to a call per chart.
 - `num samples to diff`: (`0`/`1`) This is a `0` or `1` to determine if you want the model to operate on differences of the raw data or just the raw data. For example, the default of `1` means that we take differences of the raw values. Using differences is more general and works on dimensions that might naturally tend to have some trends or cycles in them that is normal behavior to which we don't want to be too sensitive.
 - `num samples to smooth`: (`0`/`5`) This is a small integer that controls the amount of smoothing applied as part of the feature processing used by the model. For example, the default of `3` means that the rolling average of the last 3 values is used. Smoothing like this helps the model be a little more robust to spiky types of dimensions that naturally "jump" up or down as part of their normal behavior.
diff --git a/ml/ad_charts.cc b/ml/ad_charts.cc
index 086cd5aa0..bd065cfcc 100644
--- a/ml/ad_charts.cc
+++ b/ml/ad_charts.cc
@@ -124,6 +124,8 @@ void ml_update_dimensions_chart(ml_host_t *host, const ml_machine_learning_stats
                 rrddim_add(host->training_status_rs, "trained", NULL, 1, 1, RRD_ALGORITHM_ABSOLUTE);
             host->training_status_pending_with_model_rd =
                 rrddim_add(host->training_status_rs, "pending-with-model", NULL, 1, 1, RRD_ALGORITHM_ABSOLUTE);
+            host->training_status_silenced_rd =
+                rrddim_add(host->training_status_rs, "silenced", NULL, 1, 1, RRD_ALGORITHM_ABSOLUTE);
         }
 
         rrddim_set_by_pointer(host->training_status_rs,
@@ -134,6 +136,8 @@ void ml_update_dimensions_chart(ml_host_t *host, const ml_machine_learning_stats
                               host->training_status_trained_rd, mls.num_training_status_trained);
         rrddim_set_by_pointer(host->training_status_rs,
                               host->training_status_pending_with_model_rd, mls.num_training_status_pending_with_model);
+        rrddim_set_by_pointer(host->training_status_rs,
+                              host->training_status_silenced_rd, mls.num_training_status_silenced);
 
         rrdset_done(host->training_status_rs);
     }
diff --git a/ml/ml-private.h b/ml/ml-private.h
index 327cc59a2..2ed70d1ca 100644
--- a/ml/ml-private.h
+++ b/ml/ml-private.h
@@ -55,6 +55,7 @@ typedef struct machine_learning_stats_t {
     size_t num_training_status_pending_without_model;
     size_t num_training_status_trained;
     size_t num_training_status_pending_with_model;
+    size_t num_training_status_silenced;
 
     size_t num_anomalous_dimensions;
     size_t num_normal_dimensions;
@@ -103,6 +104,9 @@ enum ml_training_status {
 
     // Have a valid, up-to-date model
     TRAINING_STATUS_TRAINED,
+
+    // Have a valid, up-to-date model that is silenced because its too noisy
+    TRAINING_STATUS_SILENCED,
 };
 
 enum ml_training_result {
@@ -194,6 +198,9 @@ typedef struct {
     netdata_mutex_t mutex;
     ml_kmeans_t kmeans;
     std::vector<DSample> feature;
+
+    uint32_t suppression_window_counter;
+    uint32_t suppression_anomaly_counter;
 } ml_dimension_t;
 
 typedef struct {
@@ -233,6 +240,7 @@ typedef struct {
     RRDDIM *training_status_pending_without_model_rd;
     RRDDIM *training_status_trained_rd;
     RRDDIM *training_status_pending_with_model_rd;
+    RRDDIM *training_status_silenced_rd;
 
     RRDSET *dimensions_rs;
     RRDDIM *dimensions_anomalous_rd;
@@ -325,6 +333,9 @@ typedef struct {
     std::vector<ml_training_thread_t> training_threads;
     std::atomic<bool> training_stop;
 
+    size_t suppression_window;
+    size_t suppression_threshold;
+
     bool enable_statistics_charts;
 } ml_config_t;
 
diff --git a/ml/ml.cc b/ml/ml.cc
index 1f49f4bf1..34f2b93bd 100644
--- a/ml/ml.cc
+++ b/ml/ml.cc
@@ -63,6 +63,8 @@ ml_training_status_to_string(enum ml_training_status ts)
             return "trained";
         case TRAINING_STATUS_UNTRAINED:
             return "untrained";
+        case TRAINING_STATUS_SILENCED:
+            return "silenced";
         default:
             return "unknown";
     }
@@ -490,12 +492,16 @@ ml_dimension_add_model(const uuid_t *metric_uuid, const ml_kmeans_t *km)
     }
 
     rc = execute_insert(res);
-    if (unlikely(rc != SQLITE_DONE))
+    if (unlikely(rc != SQLITE_DONE)) {
         error_report("Failed to store model, rc = %d", rc);
+        return rc;
+    }
 
     rc = sqlite3_reset(res);
-    if (unlikely(rc != SQLITE_OK))
+    if (unlikely(rc != SQLITE_OK)) {
         error_report("Failed to reset statement when storing model, rc = %d", rc);
+        return rc;
+    }
 
     return 0;
 
@@ -504,7 +510,7 @@ bind_fail:
     rc = sqlite3_reset(res);
     if (unlikely(rc != SQLITE_OK))
         error_report("Failed to reset statement to store model, rc = %d", rc);
-    return 1;
+    return rc;
 }
 
 static int
@@ -523,7 +529,7 @@ ml_dimension_delete_models(const uuid_t *metric_uuid, time_t before)
         rc = prepare_statement(db, db_models_delete, &res);
         if (unlikely(rc != SQLITE_OK)) {
             error_report("Failed to prepare statement to delete models, rc = %d", rc);
-            return 1;
+            return rc;
         }
     }
 
@@ -536,12 +542,16 @@ ml_dimension_delete_models(const uuid_t *metric_uuid, time_t before)
         goto bind_fail;
 
     rc = execute_insert(res);
-    if (unlikely(rc != SQLITE_DONE))
+    if (unlikely(rc != SQLITE_DONE)) {
         error_report("Failed to delete models, rc = %d", rc);
+        return rc;
+    }
 
     rc = sqlite3_reset(res);
-    if (unlikely(rc != SQLITE_OK))
+    if (unlikely(rc != SQLITE_OK)) {
         error_report("Failed to reset statement when deleting models, rc = %d", rc);
+        return rc;
+    }
 
     return 0;
 
@@ -550,7 +560,7 @@ bind_fail:
     rc = sqlite3_reset(res);
     if (unlikely(rc != SQLITE_OK))
         error_report("Failed to reset statement to delete models, rc = %d", rc);
-    return 1;
+    return rc;
 }
 
 int ml_dimension_load_models(RRDDIM *rd) {
@@ -671,6 +681,8 @@ ml_dimension_train_model(ml_training_thread_t *training_thread, ml_dimension_t *
                 break;
         }
 
+        dim->suppression_anomaly_counter = 0;
+        dim->suppression_window_counter = 0;
         dim->tr = training_response;
 
         dim->last_training_time = training_response.last_entry_on_response;
@@ -727,6 +739,10 @@ ml_dimension_train_model(ml_training_thread_t *training_thread, ml_dimension_t *
 
         dim->mt = METRIC_TYPE_CONSTANT;
         dim->ts = TRAINING_STATUS_TRAINED;
+
+        dim->suppression_anomaly_counter = 0;
+        dim->suppression_window_counter = 0;
+
         dim->tr = training_response;
         dim->last_training_time = rrddim_last_entry_s(dim->rd);
 
@@ -763,6 +779,7 @@ ml_dimension_schedule_for_training(ml_dimension_t *dim, time_t curr_time)
         schedule_for_training = true;
         dim->ts = TRAINING_STATUS_PENDING_WITHOUT_MODEL;
         break;
+    case TRAINING_STATUS_SILENCED:
     case TRAINING_STATUS_TRAINED:
         if ((dim->last_training_time + (Cfg.train_every * dim->rd->update_every)) < curr_time) {
             schedule_for_training = true;
@@ -848,6 +865,7 @@ ml_dimension_predict(ml_dimension_t *dim, time_t curr_time, calculated_number_t
     switch (dim->ts) {
         case TRAINING_STATUS_UNTRAINED:
         case TRAINING_STATUS_PENDING_WITHOUT_MODEL: {
+        case TRAINING_STATUS_SILENCED:
             netdata_mutex_unlock(&dim->mutex);
             return false;
         }
@@ -855,6 +873,8 @@ ml_dimension_predict(ml_dimension_t *dim, time_t curr_time, calculated_number_t
             break;
     }
 
+    dim->suppression_window_counter++;
+
     /*
      * Use the KMeans models to check if the value is anomalous
     */
@@ -878,6 +898,13 @@ ml_dimension_predict(ml_dimension_t *dim, time_t curr_time, calculated_number_t
         sum += 1;
     }
 
+    dim->suppression_anomaly_counter += sum ? 1 : 0;
+
+    if ((dim->suppression_anomaly_counter >= Cfg.suppression_threshold) &&
+        (dim->suppression_window_counter >= Cfg.suppression_window)) {
+        dim->ts = TRAINING_STATUS_SILENCED;
+    }
+
     netdata_mutex_unlock(&dim->mutex);
 
     global_statistics_ml_models_consulted(models_consulted);
@@ -934,6 +961,13 @@ ml_chart_update_dimension(ml_chart_t *chart, ml_dimension_t *dim, bool is_anomal
                     chart->mls.num_anomalous_dimensions += is_anomalous;
                     chart->mls.num_normal_dimensions += !is_anomalous;
                     return;
+                case TRAINING_STATUS_SILENCED:
+                    chart->mls.num_training_status_silenced++;
+                    chart->mls.num_training_status_trained++;
+
+                    chart->mls.num_anomalous_dimensions += is_anomalous;
+                    chart->mls.num_normal_dimensions += !is_anomalous;
+                    return;
             }
 
             return;
@@ -987,6 +1021,7 @@ ml_host_detect_once(ml_host_t *host)
             host->mls.num_training_status_pending_without_model += chart_mls.num_training_status_pending_without_model;
             host->mls.num_training_status_trained += chart_mls.num_training_status_trained;
             host->mls.num_training_status_pending_with_model += chart_mls.num_training_status_pending_with_model;
+            host->mls.num_training_status_silenced += chart_mls.num_training_status_silenced;
 
             host->mls.num_anomalous_dimensions += chart_mls.num_anomalous_dimensions;
             host->mls.num_normal_dimensions += chart_mls.num_normal_dimensions;
@@ -1370,23 +1405,37 @@ bool ml_dimension_is_anomalous(RRDDIM *rd, time_t curr_time, double value, bool
     return is_anomalous;
 }
 
-static int ml_flush_pending_models(ml_training_thread_t *training_thread) {
-    (void) db_execute(db, "BEGIN TRANSACTION;");
+static void ml_flush_pending_models(ml_training_thread_t *training_thread) {
+    int rc = db_execute(db, "BEGIN TRANSACTION;");
+    int op_no = 1;
 
-    for (const auto &pending_model: training_thread->pending_model_info) {
-        int rc = ml_dimension_add_model(&pending_model.metric_uuid, &pending_model.kmeans);
-        if (rc)
-            return rc;
+    if (!rc) {
+        op_no++;
 
-        rc = ml_dimension_delete_models(&pending_model.metric_uuid, pending_model.kmeans.before - (Cfg.num_models_to_use * Cfg.train_every));
-        if (rc)
-            return rc;
+        for (const auto &pending_model: training_thread->pending_model_info) {
+            if (!rc)
+                rc = ml_dimension_add_model(&pending_model.metric_uuid, &pending_model.kmeans);
+
+            if (!rc)
+                rc = ml_dimension_delete_models(&pending_model.metric_uuid, pending_model.kmeans.before - (Cfg.num_models_to_use * Cfg.train_every));
+        }
+    }
+
+    if (!rc) {
+        op_no++;
+        rc = db_execute(db, "COMMIT TRANSACTION;");
     }
 
-    (void) db_execute(db, "COMMIT TRANSACTION;");
+    // try to rollback transaction if we got any failures
+    if (rc) {
+        error("Trying to rollback ML transaction because it failed with rc=%d, op_no=%d", rc, op_no);
+        op_no++;
+        rc = db_execute(db, "ROLLBACK;");
+        if (rc)
+            error("ML transaction rollback failed with rc=%d", rc);
+    }
 
     training_thread->pending_model_info.clear();
-    return 0;
 }
 
 static void *ml_train_main(void *arg) {