How to interpret Spike, Periodic, Burst, Persistent, New and Quiet labels
The behavior engine uses bounded recent occurrence timestamps and retained day activity. Labels describe observed timing and frequency evidence; they do not invent a root cause that the log did not prove.
Read the labels in context
- Treat Spike as a sharp recent increase relative to the retained preceding rate, not simply as a single severe error.
- Treat Periodic as an approximate stable repeat interval. Compare it with known scheduled jobs, but do not assume cron caused it without other evidence.
- Treat Burst as many matching errors concentrated inside a short recent window.
- Treat Persistent as a matching error active across multiple days and still seen recently.
- Use New to focus on failures first introduced recently, especially after a deployment or configuration change.
- Use Quiet to recognize a retained error that has not recurred recently. Stable rate means no stronger behavior label is currently supported.
