State of anomaly detection

Data Protector (as of 24.4) features an "anomaly detection", so I enabled it to try it out.

However the feature seems rather useless to me:

For example one host is listed repeatedly for anomaly, but I found no ways to find out *what* anomaly it caused. Opening properties I only see things like this:

The only other information source is "view session".

From these data I'll have to decide for every instance whether it's truly an anomaly, or not.

  • Suggested Answer

    0  

    It was actually introduced some versions back and I believe the last enhancements were done in the 24.3 release. The goal is to detect and report unusual patterns in sizes, number of files and backup time. You are right: as an administrator you still have to interpret what's being reported and after that Review the anomalies. The averages displayed may help to interpret the reported items. The reviews will train the system and help to avoid false positives in the future. It may take a few cycles before false positives are disappearing and it may also re-appear if the pattern is changing again.

    Although I am an OpenText employee, I am speaking for myself and not for OpenText.
    If you found this post useful, give it a “Like” or click on "Verify Answer" under the "More" button.

  • 0 in reply to   

    The GUI design as it is now is a complete failure IMHO, because it's the most unproductive and inefficient design. Consider this screenshot:

    The redacted client names are all the same, and what you can guess from the session name, there are four entries per session, and from that overview you have no clue what the status is. So the next menu that allows to accept or reject is just a waste, because you'll have to inspect the properties before you can decide. Another nonsense is the overly wide column for "Session Name" (and "Backup time").

    If there were some column to indicate the kind of anomaly, one might be able to decide. Also if the the "Review status" were a pull-down list (i.e.: anomaly/no anomaly) the user interface would be more efficient.

    As said before the properties displayed are just as useless. Consider this example: 

    So we have an "incr7" backup that has used fewer megabytes and fewer files then WHAT: The last full backup, the last INC7 backup, or the last INCR6 backup, ...? How should the user decided with the information given whether this is an anomaly, or expected? And I#m not talking about the truncated numbers, statistics like average, deviation, percentage, graphs, etc.

    This is a complete failure of design (implementation) and QA IMHO, Sorry!