Exploring smart detection notifications in Application Insights

Exploring smart detection notifications in Application Insights

Smart Detection in Application Insights is an AI-powered feature that helps you automatically identify anomalies and issues in your application before they are noticed by users. This proactive monitoring can significantly reduce the time needed to detect, triage, and resolve problems. Smart Detection notifications are generated based on machine learning models that continuously analyze telemetry data for patterns and outliers.

Let’s explore Smart Detection notifications in detail, focusing on how they work, how they can help in triage, scope, and diagnosis, and how to use them to troubleshoot issues effectively.

1. What is Smart Detection?

Smart Detection uses machine learning algorithms to automatically detect anomalies in key performance indicators (KPIs) and generate actionable alerts based on thresholds and patterns.

It continuously analyzes data from Application Insights, such as:

1. Requests (successful and failed HTTP requests)

2. Exceptions (errors thrown by the application)

3. Dependencies (external calls to databases, APIs, etc.)

4. Performance metrics (response times, CPU usage, etc.)

Smart Detection can alert you about various types of issues, such as:

1. Anomalies in response times (e.g., unusually slow API responses)

2. Increase in failure rates (e.g., higher-than-normal 500 error rates)

3. Performance degradation (e.g., system lag or slowdowns)

4. Increased exception rates (e.g., unhandled exceptions)

These notifications can help you detect issues in real-time and reduce the time between problem onset and resolution, improving application reliability.

2. How Smart Detection Notifications Work

Smart Detection automatically analyzes metrics from your Application Insights data and uses machine learning to detect anomalies and patterns that deviate from the normal behavior of your application. When such an anomaly is detected, Smart Detection notifications are triggered.

Some common types of Smart Detection notifications include:

1. Request Failure Rates: Alerts when there is an unusual spike in request failure rates (e.g., more than a certain percentage of requests fail).

2. Request Latency: Notifies you when request response times significantly increase.

3. Exceptions: Generates notifications when there is an increase in the rate of exceptions, such as errors in your code.

4. Dependency Failures: Alerts when an external dependency (like a database or API) is having problems.

5. Performance Degradation: Notifies you if the application’s performance is degrading over time (e.g., slow database queries).

These notifications are delivered through Application Insights channels, such as:

1. Email

2. SMS (via integration with other services like Azure Monitor)

3. Webhook

4. Azure Portal alerts and notifications

3. Key Features of Smart Detection Notifications

1. AI-powered Anomaly Detection:

Smart Detection uses machine learning models that continuously analyze incoming telemetry data and compare it against historical patterns to identify when something out of the ordinary occurs.

2. Customized Sensitivity:

Smart Detection learns what constitutes "normal" for your application over time and adapts accordingly. This reduces the chance of false positives (alerts for issues that aren't real problems) and improves the accuracy of the detection.

3. Root Cause Analysis:

In addition to identifying anomalies, Smart Detection provides useful diagnostic information, such as:

• Which metrics or events are anomalous.

• How much the anomaly deviates from the baseline.

• A timeline of the anomaly, showing when the problem started and its duration.

4. Automatic Context:

When an anomaly is detected, the notification often includes contextual data about the issue, such as:

• Anomalous metrics (e.g., error rates, response times, or throughput).

• A correlation with recent changes, such as deployments or updates that may have caused the issue.

• Impact analysis, such as how many users or transactions were affected.

4. How to Use Smart Detection Notifications (Triage, Scope, Diagnose)

Let’s break down how Smart Detection notifications can help in triaging, scoping, and diagnosing issues.

Triage: Initial Assessment of the Problem

When a Smart Detection notification comes in, it gives you the first indication of a potential issue. The notification includes high-level data that will allow you to triage the issue and assess its severity.

What You’ll See in a Smart Detection Notification:

1. Anomaly Type: Description of the issue, such as "spike in 5xx errors" or "increase in response time."

2. Severity Level: This indicates how critical the issue is (e.g., "Critical", "Warning").

3. Time Frame: The time period in which the anomaly was detected. You can also see if the issue is ongoing.

4. Impacted Metric: Whether the issue is related to requests, dependencies, exceptions, etc.

Example:

You receive an alert that says:

1. Anomaly: "Request failure rate increased by 30%."

2. Time Frame: "Between 12:00 PM and 12:30 PM UTC."

3. Severity: "Critical."

4. Impacted Metric: "Failed requests to /api/checkout."

In this case, you can immediately identify that something went wrong with the checkout API, and the failure rate spiked by 30%. The alert is marked as critical, so it demands your immediate attention.

Scope: Understanding the Extent of the Problem

Once you’ve triaged the issue and confirmed it's critical, you’ll need to scope the problem to understand its extent.

You need to determine:

• Which parts of your application are affected?

• How many users are impacted?

• What services or components are involved?

Application Insights Features to Help You Scope the Issue:

1. Correlated Alerts: Smart Detection often includes a correlation ID or session ID, which allows you to trace the problem across different parts of your application. You can follow a specific request and see how it propagates through your system.

2. Application Map: Smart Detection will highlight dependencies or components that are underperforming. The Application Map can visually show if a backend service, database, or external API is experiencing issues.

3. Telemetry Data: If the failure rate is related to an API endpoint, you can review request telemetry, such as:

• Request response times (are they slow or increasing over time?)

• Error codes (e.g., 500, 502).

• Failed dependencies (e.g., database or API failures).

Example:

For the issue with the checkout API, you might notice that the failure is localized to transactions involving a particular payment gateway. By looking at the Application Map, you can see that the payment-gateway dependency has high response times, which could be contributing to the issue.

Diagnose: Identify the Root Cause

The diagnosis phase is about pinpointing the exact root cause of the anomaly or failure. Smart Detection doesn’t just point out that something is wrong; it often provides diagnostic insights that help you get closer to the root cause.

How Smart Detection Helps You Diagnose:

1. Contextual Information: Smart Detection often includes additional context, such as:

   • Recent changes (e.g., a recent deployment or update that might have introduced the issue).

   • Performance metrics that indicate slow responses or failures (e.g., high CPU usage, slow database queries).

2. Dependency Failures: If an external service or API is failing, Smart Detection will provide details on which dependency is impacted, such as timeouts or error responses.

3. Time Series Data: The alert typically includes a timeline of the anomaly, which helps you understand when the issue started and how it evolved. This is especially useful for detecting performance degradations or gradual increases in failure rates.

Example:

1. For the issue with checkout API failures:

2. You see that the payment gateway’s response times increased significantly at 12:00 PM (the same time the failure rate spiked).

3. Database queries to retrieve payment details are taking longer than usual due to an index issue.

4. A recent database schema change could be the root cause, as it may have resulted in inefficient queries.

By using the Application Insights Search and Performance Metrics features, you confirm that database queries are the root cause of the increased latency in the payment-gateway dependency.

5. Smart Detection Use Cases

Smart Detection is a great tool for a variety of use cases in application monitoring, such as:

1. Proactive Monitoring:

Automatically detect issues before they affect your users, helping you stay ahead of potential downtime or performance problems.

2. Root Cause Identification:

Quickly diagnose performance issues, such as slow APIs, high error rates, or database bottlenecks.

3. Continuous Performance Monitoring:

Keep track of response times and throughput over time, with automatic alerts when something deviates from normal.

4. Anomaly Detection:

Detect unusual patterns that might not have been captured by traditional threshold-based alerting.

6. Best Practices for Smart Detection Notifications

1. Set Up Email/SMS Notifications:

Ensure that Smart Detection notifications are configured to send alerts to the right people or teams.

2. Fine-tune Sensitivity:

Over time, adjust the sensitivity and alert thresholds of Smart Detection to minimize false positives and ensure that alerts are actionable.

3. Review Telemetry Data Regularly:

Even when no alerts are triggered, it’s a good idea to periodically check the telemetry data (using Application Insights Search and Application Map) to identify slowdowns, unusual patterns, or other subtle performance issues.

4. Combine with Other Alerts:

Use Smart Detection in combination with other Application Insights alerting rules (e.g., custom thresholds for specific KPIs) for a comprehensive monitoring strategy.

Summary

Smart Detection notifications in Application Insights are powerful tools for proactively identifying and diagnosing issues in your application. By leveraging AI-powered anomaly detection, Smart Detection helps you quickly spot performance issues, request failures, exceptions, and other anomalies that could impact your users.

With the right context, correlation data, and performance metrics, you can rapidly triage, scope, and diagnose the root cause of these issues to ensure quick resolution and minimal downtime.