Real-Time Monitoring - The Renacer Book - Pure Rust System Call Tracing
Description: A comprehensive guide to renacer: syscall tracing, DWARF correlation, and performance analysis

# Real-Time Anomaly Detection

Real-time anomaly detection monitors syscalls during execution, alerting on unusual behavior as it happens.

> TDD-Verified: Real-time monitoring tested in `tests/sprint20_anomaly_detection_tests.rs`

> Parent Chapter: See Anomaly Detection for overview

## Overview

Real-time detection identifies anomalies during tracing:

- Threshold alerts - Syscalls exceeding time/frequency limits
- Pattern matching - Unusual syscall sequences
- Live filtering - Focus on anomalous events only

When to use:

- Production monitoring
- Live debugging sessions
- Performance regression alerts

## Real-Time Filtering

### Threshold-Based Monitoring

Alert on slow syscalls (>10ms):

    $ renacer -- ./myapp 2>&1 | awk '
      /=/ {
        # Extract duration from output
        if (match($0, /([0-9]+) μs/, arr)) {
          duration_us = arr[1]
          if (duration_us > 10000) {
            print "⚠️ SLOW SYSCALL:", $0
          }
        }
      }
    '

Example Output:

    ⚠️ SLOW SYSCALL: fsync(3) = 0   [15234 μs]
    ⚠️ SLOW SYSCALL: read(4, ...) = 1024   [12456 μs]

###

Frequency Anomalies

Detect syscall storms (>1000 calls/sec):

    $ renacer -- ./myapp 2>&1 | awk '
      BEGIN { count = 0; start = systime() }
      /openat/ { count++ }
      {
        now = systime()
        if (now > start) {
          rate = count / (now - start)
          if (rate > 1000) {
            print "⚠️ SYSCALL STORM: openat rate =", rate, "calls/sec"
          }
          count = 0
          start = now
        }
      }
    '

## Summary

Real-time anomaly detection provides:

- ✅ Live monitoring during execution
- ✅ Threshold alerts for slow/frequent syscalls
- ✅ Pattern detection for unusual sequences

Workflow: Pipe Renacer output → awk/grep filtering → Real-time alerts

All real-time monitoring tested in: `tests/sprint20_anomaly_detection_tests.rs`

## Related

- Anomaly Detection - Parent chapter
- Post-Hoc Anomaly Detection - Offline analysis
- Filtering Syscalls - Filter syntax