Restart-Rate Anomaly Detection
A queue worker restarting hourly is normal. A database restarting hourly isn't.
A single fixed threshold ("alert after 3 restarts") can't express that — different containers have wildly different normal cadences by design. So instead of a global number, Kllyroo computes an exponential-moving-average baseline of restart rate per container, learned from that container's own history, and flags a deviation from its own normal — not from an arbitrary constant.
The baseline starts from a short bootstrap period before going live, so a freshly deployed container isn't falsely flagged on day one just for having no history yet.
Restart baseline — gochat-postgres-1
ALERT · restart_rate_anomalygochat-postgres-1
Restart rate is well above this container's own baseline — 5 restarts in 15 min vs. a typical 0.1.
Fix: check the container's own logs for the crash reason — this is a real deviation from its normal cadence, not noise.