Detection that knows the difference between weird and normal.
Static CloudWatch thresholds fire constantly because they don't know what your normal looks like. Error watch keeps a rolling 6-hour baseline per service, suppresses known recurring patterns, and fires only when something actually changed.
- 14:02edge-cdn 502 burst — known upstream flap
- 13:48search-api timeout pattern — recurring
- 13:31auth-svc cold-start spike — within baseline
- 13:14primary-db slow-query — on follow-up cooldown
- 12:45session-svc 429 — within rate-limit baseline
- 14:21payments-api p99 11.4s — deploy v3.42.1 correlated
- 12:08users-api 5xx +820% — SQS depth ×4.2
- 09:44rds-prod-1 IOPS saturation — customer-facing
What changes for the on-call engineer
412 known-noise blips suppressed today. Your team only saw 3 pages — the ones that mattered.
We know your Tuesday 10am traffic looks different from Saturday 3am. Static thresholds don't.
Mark a finding as known noise once — Radar never wakes you for it again.
How it works
Sample
Every 60 seconds, error patterns are extracted from your service log groups.
Compare
Rate, novelty, and concentration are compared against the 6-hour rolling baseline.
Gate
Multiple gates (volume, novelty, customer-impact, deploy proximity) decide: surface or suppress.