Threshold downtime alerts vs. anomaly detection — is fancier better?

Threshold downtime alerts vs. anomaly detection — is fancier better?

Q: Should I move from simple thresholds to anomaly-detection alerting?

A: For availability, plain thresholds win and you should keep them. "Site returns an error" is binary — there's no anomaly to learn, and threshold logic is predictable, debuggable, and never mysteriously goes quiet. Anomaly detection on a simple up/down signal mostly adds complexity and false positives.

Where anomaly detection earns its keep is gradual, traffic-shaped metrics: response time that's slow only at peak, error rates that should be near-zero, request volume that suddenly drops to a fraction of normal (a sign of a silent partial outage a threshold would miss).

So keep hard thresholds for is-it-up, and consider anomaly detection for is-it-behaving-normally. The trap: never let a learned baseline silently "adapt" to a degraded state and stop alerting — pin a hard floor underneath it as a safety net.

Got a question? Drop it in the comments.