baseline_check
Read-only
Compares recent samples against a learned baseline to detect sustained violations beyond p1/p99 by 3×MAD, citing the baseline window and offending samples. Returns ok, violation, or no_baseline.
Instructions
[READ][risk=low] Check recent local samples against the learned baseline.
Reads the last window_s seconds from ~/.iaiops/data.db (no device I/O) and
judges them against the stored band. Conservative by design: a violation is
reported ONLY when values are beyond p1/p99 by more than 3×MAD AND sustained
for >=3 consecutive samples — a single spike is never flagged. Every
violation cites the baseline window (from/to ts, n samples), the band
values, and the offending samples' timestamps/values. No stored baseline →
an explicit no_baseline answer (never a guess). Bounded output (<=10
violations, <=20 cited samples each).
Args:
tag: Tag name to check, e.g. 'line1.temp'.
endpoint: Only samples from this endpoint label.
window_s: Recent window to check, seconds (60..604800; default 3600).
Returns dict: {status: 'ok'|'violation'|'no_baseline', tag, checked_samples,
thresholds, baseline_citation, violations:[{direction, from_ts, to_ts,
consecutive_samples, samples:[{ts,value}], baseline}], note}.
Example: baseline_check(tag="line1.temp", window_s=7200).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tag | Yes | ||
| endpoint | No | ||
| window_s | No |