Real-Time Anomaly Detection

Real-time anomaly detection monitors syscalls during execution, alerting on unusual behavior as it happens.

TDD-Verified: Real-time monitoring tested in tests/sprint20_anomaly_detection_tests.rs

Parent Chapter: See Anomaly Detection for overview

Overview

Real-time detection identifies anomalies during tracing:

  • Threshold alerts - Syscalls exceeding time/frequency limits
  • Pattern matching - Unusual syscall sequences
  • Live filtering - Focus on anomalous events only

When to use:

  • Production monitoring
  • Live debugging sessions
  • Performance regression alerts

Real-Time Filtering

Threshold-Based Monitoring

Alert on slow syscalls (>10ms):

$ renacer -- ./myapp 2>&1 | awk '
  /=/ {
    # Extract duration from output
    if (match($0, /([0-9]+) μs/, arr)) {
      duration_us = arr[1]
      if (duration_us > 10000) {
        print "⚠️ SLOW SYSCALL:", $0
      }
    }
  }
'

Example Output:

⚠️ SLOW SYSCALL: fsync(3) = 0   [15234 μs]
⚠️ SLOW SYSCALL: read(4, ...) = 1024   [12456 μs]

Frequency Anomalies

Detect syscall storms (>1000 calls/sec):

$ renacer -- ./myapp 2>&1 | awk '
  BEGIN { count = 0; start = systime() }
  /openat/ { count++ }
  {
    now = systime()
    if (now > start) {
      rate = count / (now - start)
      if (rate > 1000) {
        print "⚠️ SYSCALL STORM: openat rate =", rate, "calls/sec"
      }
      count = 0
      start = now
    }
  }
'

Summary

Real-time anomaly detection provides:

  • ✅ Live monitoring during execution
  • ✅ Threshold alerts for slow/frequent syscalls
  • ✅ Pattern detection for unusual sequences

Workflow: Pipe Renacer output → awk/grep filtering → Real-time alerts

All real-time monitoring tested in: tests/sprint20_anomaly_detection_tests.rs