From 0fcda7d0071c5499d96128aa127b064b919b73f3 Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Thu, 17 Jul 2025 14:05:25 +0200 Subject: [PATCH 1/8] [ccm] anomalies - adding info about watchdog explains --- content/en/cloud_cost_management/anomalies.md | 24 +++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index 79d700554da55..e7b82ab038251 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -21,7 +21,10 @@ Our algorithm takes into account seasonality, distinguishing true anomalies from To further reduce noise, anomalies with low cost impact are automatically filtered out, ensuring your attention stays focused on the largest anomalies. +Once anomalies are detected, to troubleshoot the root cause we are using the same concept as [Watchdog Explains][2]. It will automatically analyzes your cost data to identify which specific tags or dimensions are responsible for the anomalous behavior, helping you get the related service, team, environment, account, and other factors driving the cost spike. This accelerates your investigation and resolution process by quickly pinpointing the source of unexpected costs. + [1]: https://app.datadoghq.com/cost/analyze/anomalies +[2]: /dashboards/graph_insights/watchdog_explains ## View cost anomalies @@ -38,9 +41,24 @@ This is an example of the list of anomalies detected in your infrastructure: {{< img src="cloud_cost/anomalies/cost_anomalies_new_list.png" alt="List of cost anomalies automatically detected" style="width:90%;" >}} -## Take action on anomalies + + +When hovering over the graph, you can see two graphs: one with and one without the tags identified by the Watchdog Explains engine, it shows how removing XXX:XXX flattens the spike, confirming the impact on the cost. + +## Investigate an anomaly -Click an anomaly to view the services, teams, environments, and resource IDs that may be driving the cost anomaly. +When you open an anomaly, the investigation panel provides: + +- **Impact summary and drivers**: A comprehensive overview summarizing the impact and identifying the key drivers responsible for the cost anomaly. +- **Related driver graphs**: Visual representations showing graphs from the related drivers that contributed to the anomalous behavior. +- **Usage vs. unit price analysis**: A dedicated section to help you understand whether the unexpected change is due to increased usage, unit price changes, or both. +- **Resource investigation table**: A detailed table allowing you to investigate potential impactful resource IDs that may be contributing to the cost spike. + + + + + +## Take action on anomalies Investigate the anomaly further, and by any additional dimensions, by viewing the costs in Explorer or saving the query to a Notebook. You can also send the anomaly, Explorer link, or Notebook to the associated service owners or teams. This enables teams to provide context for why the anomaly occurred, and if it's expected. @@ -48,6 +66,7 @@ You can also create a cost anomaly monitor to get alerted of similar cost anomal This is the side panel where you can take action on your cost anomaly: + {{< img src="cloud_cost/anomalies/cost_anomalies_side-panel.png" alt="In the side panel you can take action on your cost anomaly" style="width:90%;" >}} ## Resolve anomalies @@ -58,4 +77,5 @@ Mark anomalies as significant or insignificant to give feedback and help improve This is an example of how to mark a cost anomaly as significant and explain why it's an anomaly: + {{< img src="cloud_cost/anomalies/cost_anomalies_side-panel_is-significant.png" alt="You can mark cost anomaly as significant and write an explanation about why it's an anomaly and then resolve it" style="width:90%;" >}} From 3b75377dcf26f3e6947ebdfeecb62eb2514d1e49 Mon Sep 17 00:00:00 2001 From: goeln Date: Thu, 17 Jul 2025 11:13:17 -0400 Subject: [PATCH 2/8] Update anomalies.md --- content/en/cloud_cost_management/anomalies.md | 39 ++++++++++++------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index e7b82ab038251..7c49a61668f89 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -21,11 +21,6 @@ Our algorithm takes into account seasonality, distinguishing true anomalies from To further reduce noise, anomalies with low cost impact are automatically filtered out, ensuring your attention stays focused on the largest anomalies. -Once anomalies are detected, to troubleshoot the root cause we are using the same concept as [Watchdog Explains][2]. It will automatically analyzes your cost data to identify which specific tags or dimensions are responsible for the anomalous behavior, helping you get the related service, team, environment, account, and other factors driving the cost spike. This accelerates your investigation and resolution process by quickly pinpointing the source of unexpected costs. - -[1]: https://app.datadoghq.com/cost/analyze/anomalies -[2]: /dashboards/graph_insights/watchdog_explains - ## View cost anomalies On the [Anomalies tab of the Cloud Cost page in Datadog][1], you can view the anomalies and filter them to Active, Past, or Resolved: @@ -45,29 +40,42 @@ This is an example of the list of anomalies detected in your infrastructure: When hovering over the graph, you can see two graphs: one with and one without the tags identified by the Watchdog Explains engine, it shows how removing XXX:XXX flattens the spike, confirming the impact on the cost. -## Investigate an anomaly +## Understand what's driving anomalies + +CCM automatically uses Watchdog Explains[2], an investigation assistant, to help you identify who is driving cost anomalies. Watchdog Explains analyzes and identifies the specific: + +- accounts +- teams +- services +- Kubernetes or ECS clusters +- regions + +Where the anomaly happened, reducing manual investigation steps. Before you even click on the anomaly, you can hover over the anomaly graph and see the costs with and without tags identified as influential by Watchdog Explains, to confirm that the identified tags are indeed driving the anomaly. + + -When you open an anomaly, the investigation panel provides: +To further investigate and share anomalies with the relevant owners, you can open an anomaly for more details. The investigation panel provides: - **Impact summary and drivers**: A comprehensive overview summarizing the impact and identifying the key drivers responsible for the cost anomaly. - **Related driver graphs**: Visual representations showing graphs from the related drivers that contributed to the anomalous behavior. -- **Usage vs. unit price analysis**: A dedicated section to help you understand whether the unexpected change is due to increased usage, unit price changes, or both. +- **Usage vs. unit price analysis**: A dedicated section to help you understand whether the unexpected change is due to increased usage, unit price changes, or both. Usage driven anomalies should be shared with the responsible engineering teams identified by Watchdog Explains to help explain the cause for the change in usage. Unit price changes are often caused by changes in commitment programs or contracted discounts. - **Resource investigation table**: A detailed table allowing you to investigate potential impactful resource IDs that may be contributing to the cost spike. - + ## Take action on anomalies -Investigate the anomaly further, and by any additional dimensions, by viewing the costs in Explorer or saving the query to a Notebook. You can also send the anomaly, Explorer link, or Notebook to the associated service owners or teams. This enables teams to provide context for why the anomaly occurred, and if it's expected. +To further investigate anomalies by additional dimensions, view the anomaly in Cost Explorer or a Datadog Notebook. -You can also create a cost anomaly monitor to get alerted of similar cost anomalies in the future. + -This is the side panel where you can take action on your cost anomaly: +You can also send the anomaly, Explorer link, or Notebook to the service owners or teams identified by Watchdog Explains. This enables teams to resolve anomalies with context for why the anomaly occurred, and if it's expected. - -{{< img src="cloud_cost/anomalies/cost_anomalies_side-panel.png" alt="In the side panel you can take action on your cost anomaly" style="width:90%;" >}} +You can also create a cost anomaly monitor to get alerted of similar cost anomalies in the future. + + ## Resolve anomalies @@ -79,3 +87,6 @@ This is an example of how to mark a cost anomaly as significant and explain why {{< img src="cloud_cost/anomalies/cost_anomalies_side-panel_is-significant.png" alt="You can mark cost anomaly as significant and write an explanation about why it's an anomaly and then resolve it" style="width:90%;" >}} + +[1]: https://app.datadoghq.com/cost/analyze/anomalies +[2]: /dashboards/graph_insights/watchdog_explains From 2be57db8e17e4a23c9610e4b0b4dcdd5a7cb38b0 Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Fri, 18 Jul 2025 09:54:09 +0200 Subject: [PATCH 3/8] Update content/en/cloud_cost_management/anomalies.md Co-authored-by: Rosa Trieu <107086888+rtrieu@users.noreply.github.com> --- content/en/cloud_cost_management/anomalies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index 7c49a61668f89..9174a32322bfa 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -38,7 +38,7 @@ This is an example of the list of anomalies detected in your infrastructure: -When hovering over the graph, you can see two graphs: one with and one without the tags identified by the Watchdog Explains engine, it shows how removing XXX:XXX flattens the spike, confirming the impact on the cost. +When hovering over the graph, you can see two graphs: one with and one without the tags identified by the Watchdog Explains engine. This shows how removing XXX:XXX flattens the spike, confirming the impact on the cost. ## Understand what's driving anomalies From 272b9c281a251b7947e2bf5a504e0d1b67207ce9 Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Fri, 18 Jul 2025 09:54:18 +0200 Subject: [PATCH 4/8] Update content/en/cloud_cost_management/anomalies.md Co-authored-by: Rosa Trieu <107086888+rtrieu@users.noreply.github.com> --- content/en/cloud_cost_management/anomalies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index 9174a32322bfa..83ea5be514a38 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -50,7 +50,7 @@ CCM automatically uses Watchdog Explains[2], an investigation assistant, to help - Kubernetes or ECS clusters - regions -Where the anomaly happened, reducing manual investigation steps. Before you even click on the anomaly, you can hover over the anomaly graph and see the costs with and without tags identified as influential by Watchdog Explains, to confirm that the identified tags are indeed driving the anomaly. +where the anomaly happened, reducing manual investigation steps. Before you even click on the anomaly, you can hover over the anomaly graph and see the costs with and without tags identified as influential by Watchdog Explains, to confirm that the identified tags are indeed driving the anomaly. From 34b4a2bf606313a580640e39acd43720eb6e41c2 Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Fri, 18 Jul 2025 09:54:39 +0200 Subject: [PATCH 5/8] Update content/en/cloud_cost_management/anomalies.md Co-authored-by: Rosa Trieu <107086888+rtrieu@users.noreply.github.com> --- content/en/cloud_cost_management/anomalies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index 83ea5be514a38..f893e2785b9f6 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -42,7 +42,7 @@ When hovering over the graph, you can see two graphs: one with and one without t ## Understand what's driving anomalies -CCM automatically uses Watchdog Explains[2], an investigation assistant, to help you identify who is driving cost anomalies. Watchdog Explains analyzes and identifies the specific: +CCM automatically uses Watchdog Explains[2], an investigation assistant, to help you identify what is driving cost anomalies. Watchdog Explains analyzes and identifies the specific: - accounts - teams From a42a2301521806f63a91144b3ddf1c8ab9c06ba0 Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Fri, 18 Jul 2025 10:12:45 +0200 Subject: [PATCH 6/8] Update content/en/cloud_cost_management/anomalies.md Co-authored-by: Rosa Trieu <107086888+rtrieu@users.noreply.github.com> --- content/en/cloud_cost_management/anomalies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index f893e2785b9f6..d8ff97790faf9 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -58,7 +58,7 @@ To further investigate and share anomalies with the relevant owners, you can ope - **Impact summary and drivers**: A comprehensive overview summarizing the impact and identifying the key drivers responsible for the cost anomaly. - **Related driver graphs**: Visual representations showing graphs from the related drivers that contributed to the anomalous behavior. -- **Usage vs. unit price analysis**: A dedicated section to help you understand whether the unexpected change is due to increased usage, unit price changes, or both. Usage driven anomalies should be shared with the responsible engineering teams identified by Watchdog Explains to help explain the cause for the change in usage. Unit price changes are often caused by changes in commitment programs or contracted discounts. +- **Usage versus unit price analysis**: A dedicated section to help you understand whether the unexpected change is due to increased usage, unit price changes, or both. Usage-driven anomalies should be shared with the responsible engineering teams identified by Watchdog Explains to help explain the cause for the change in usage. Unit price changes are often caused by changes in commitment programs or contracted discounts. - **Resource investigation table**: A detailed table allowing you to investigate potential impactful resource IDs that may be contributing to the cost spike. From c76ff1df9a2ee294e30d62e948b0b5949fbea24a Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Fri, 18 Jul 2025 10:12:53 +0200 Subject: [PATCH 7/8] Update content/en/cloud_cost_management/anomalies.md Co-authored-by: Rosa Trieu <107086888+rtrieu@users.noreply.github.com> --- content/en/cloud_cost_management/anomalies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index d8ff97790faf9..b62f9245574cd 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -71,7 +71,7 @@ To further investigate anomalies by additional dimensions, view the anomaly in C -You can also send the anomaly, Explorer link, or Notebook to the service owners or teams identified by Watchdog Explains. This enables teams to resolve anomalies with context for why the anomaly occurred, and if it's expected. +You can also send the anomaly, Explorer link, or Notebook to the service owners or teams identified by Watchdog Explains. This enables teams to resolve anomalies with context for why the anomaly occurred and whether it's expected. You can also create a cost anomaly monitor to get alerted of similar cost anomalies in the future. From 5d1c32eccbb910000a5a6ac3883c0f951e2a74b3 Mon Sep 17 00:00:00 2001 From: Jonathan Kauch Date: Fri, 18 Jul 2025 10:13:00 +0200 Subject: [PATCH 8/8] Update content/en/cloud_cost_management/anomalies.md Co-authored-by: Rosa Trieu <107086888+rtrieu@users.noreply.github.com> --- content/en/cloud_cost_management/anomalies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud_cost_management/anomalies.md b/content/en/cloud_cost_management/anomalies.md index b62f9245574cd..984ccd19f9859 100644 --- a/content/en/cloud_cost_management/anomalies.md +++ b/content/en/cloud_cost_management/anomalies.md @@ -67,7 +67,7 @@ To further investigate and share anomalies with the relevant owners, you can ope ## Take action on anomalies -To further investigate anomalies by additional dimensions, view the anomaly in Cost Explorer or a Datadog Notebook. +To further investigate anomalies by using additional dimensions, view the anomaly in Cost Explorer or a Datadog Notebook.