Skip to content

anomaly

anomaly

Heuristic anomaly detection for the Marianne system profiler.

Compares the current SystemSnapshot against recent history to detect resource anomalies: memory spikes, runaway processes, zombies, and FD exhaustion. No LLM calls — pure threshold-based detection.

Detected anomalies are published to the EventBus as monitor.anomaly events and stored as RESOURCE_ANOMALY patterns in the learning system.

Attributes

FD_EXHAUSTION_THRESHOLD module-attribute 

FD_EXHAUSTION_THRESHOLD = 1000

Open FD count that triggers an FD exhaustion anomaly.

MEMORY_PRESSURE_FRACTION module-attribute 

MEMORY_PRESSURE_FRACTION = 0.1

Available/total memory ratio below which memory pressure is flagged.

Classes

AnomalyDetector 

AnomalyDetector(config=None)

Detects resource anomalies by comparing snapshots against thresholds.

Runs on each new snapshot collected by ProfilerCollector. Stateless except for the configuration — all history is passed in via the detect method.

Source code in src/marianne/daemon/profiler/anomaly.py 
37
38
def __init__(self, config: AnomalyConfig | None = None) -> None:
    self.config = config or AnomalyConfig()
Functions
detect 
detect(current, history)

Run all anomaly checks against current snapshot and history.

Parameters:

Name Type Description Default
current SystemSnapshot

The most recent system snapshot.

 required
history list[SystemSnapshot]

Recent snapshots (oldest-first) for trend analysis. Should cover at least the configured spike window.

 required

Returns:

Type Description
list[Anomaly]

List of detected Anomaly objects (may be empty).
Source code in src/marianne/daemon/profiler/anomaly.py 
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
def detect(
    self,
    current: SystemSnapshot,
    history: list[SystemSnapshot],
) -> list[Anomaly]:
    """Run all anomaly checks against *current* snapshot and *history*.

    Args:
        current: The most recent system snapshot.
        history: Recent snapshots (oldest-first) for trend analysis.
                 Should cover at least the configured spike window.

    Returns:
        List of detected ``Anomaly`` objects (may be empty).
    """
    anomalies: list[Anomaly] = []
    anomalies.extend(self._check_memory_spikes(current, history))
    anomalies.extend(self._check_runaway_processes(current, history))
    anomalies.extend(self._check_zombies(current))
    anomalies.extend(self._check_fd_exhaustion(current))
    anomalies.extend(self._check_memory_pressure(current))
    return anomalies