Introduction
Open the MongoStat tab and NoSqlStudio polls serverStatus() every 1.5 s. The sparklines you already know are now backed by an anomaly detector that scans the rolling ring buffer on every render. When something abnormal sustains for two ticks, it surfaces as a red banner at the top + a row in the Detected anomalies grid + a clickable button that opens the IncidentDrawer for AI-assisted root-cause analysis.
Concept
Why this matters
The chart used to be passive — you had to read it. Now it talks back: the detector flags 5 classes of trouble and the AI explains the most likely cause in a 3-stop walk, in your locale. Same stream, way less squinting.
How to read this guide
Each of the 5 anomalies has the same shape: what triggers it, what the drawer shows, what the action button does. The action button never blasts a change — it always opens the drawer for non-kill cases, and asks confirmation for the kill case.
connection-saturation
Fires when current / max connections crosses 0.75 sustained for two ticks. Severity goes medium → high at 0.90.
Trigger
connections.current / (current + available) ≥ 0.75 on two consecutive samples.
Heads-up
Atlas free tier (M0/M2/M5)
Shared-tier clusters don't expose wiredTiger.cache.maximum bytes configured. We treat the absence as a free-tier signal *only after 30 ticks of evidence and only on \.mongodb.net hosts** — to stop dedicated clusters from being flagged with a fake ~500 cap during the first wt-less seconds.
Drawer payload
Context section lists current/max/available, the surrounding ops/s rates, and any structured incident metadata. AI section runs the 3-stop walk (What / Why / How). Actions offers "Show top connections" which drills into currentOp grouped by app.
opcounter-spike
Fires when any opcounter (inserts/query/update/delete/getmore/command) crosses μ + 3σ of its 5-minute rolling mean AND is > 1.5× μ, sustained two ticks.
Trigger
Floor of 5 ops/s. The detector emits one row per spike — the first counter that crosses, not six near-identical ones.
Drawer payload
Counter name + spike ratio + baseline μ are surfaced as deterministic context. Action: "Show top ops" filters currentOp by the offending verb.
netout-surge
Fires when netOutKB exceeds 3× rolling mean AND the query rate is NOT proportionally up — the classic signature of an unindexed scan returning huge payloads.
Trigger
Quiet floor of 32 KB/s rolling mean (we ignore idle servers). Sustained two ticks, with netRatio > queryRatio × 1.5.
Drawer payload
MB/s + netOut:query ratio in the context. Action: "Find slow queries" links to the Profiler workspace.
currentop-pileup
Fires when ≥ 5 ops have elapsed > 1 s simultaneously, sustained two ticks. Requires Capture Ops to be enabled in the toolbar.
Capture Ops gating
Concept
Dormant when Capture Ops is off
The grid shows a 💡 hint when it is — to remind you the rule is sitting silent, not broken.
Action — Kill
Heads-up
Two-step kill
The grid's Kill long-running → button asks for confirmation, then opens the long-running list. Each individual killOp inside the list also prompts again. Two prompts, no surprises.
replication-lag
Only relevant on replica sets. The poller calls replSetGetStatus() every 30 s and derives max(primaryOptime − secondaryOptime). Fires at > 5 s, severity high above 60 s.
Trigger
Managed clusters that reject replSetGetStatus silently disable this rule — no spammy errors.
Action — Open RS Status
Dispatches compass:mongostat:open-rs-status so the host can deep-link into the RS Status workspace. Falls back to the connection drilldown when no listener is wired.
Muting false positives
ETL jobs and scheduled batch loads sometimes look like spikes. Every anomaly row has an ✕ button (and the drawer has an "Ignore this incident" button). Clicking it persists the signature (kind + scope + 5-min bucket + severity) to localStorage — so the next time the same pattern hits, the detector skips it for you.
Want to un-mute? Clear compass:mongostat:dismissed-signatures in DevTools, or use the upcoming Settings panel.
Summary
| Anomaly | Trigger | Severity bumps to high at | Action button |
|---|---|---|---|
| connection-saturation | current/max ≥ 0.75 × 2 ticks | ratio ≥ 0.90 | Show top connections |
| opcounter-spike | any counter > μ + 3σ × 2 ticks | ratio > 6× μ | Show top ops |
| netout-surge | netOut > 3× μ, query rate flat × 2 ticks | netRatio > 6× | Find slow queries |
| currentop-pileup | ≥ 5 ops > 1s × 2 ticks (Capture Ops on) | ≥ 20 long ops | Kill long-running (confirm) |
| replication-lag | primary→secondary lag > 5 s × 2 ticks | lag > 60 s | Open RS Status |