Overview

Datadog Cloud Cost Management (CCM) continuously monitors your environment to detect and prioritize unexpected cost changes, enabling you to share, investigate, and resolve anomalies. Cost anomalies are available for AWS, and do not require any additional setup after CCM is set up.

How anomalies are defined

Anomalies are irregular or unexpected changes that significantly deviate from established patterns. Datadog uses a machine learning-based anomaly detection algorithm that automatically filters out weekly seasonality and anomalies below $5 to reduce noise.

Weekly seasonality further reduces noise by identifying expected weekly patterns. For example, many businesses spin down a part of their infrastructure over the weekend and spin back up on Mondays, which causes a cost increase that shouldn’t be flagged as an anomaly.

View cost anomalies

On the Anomalies tab of the Cloud Cost page in Datadog, you can view the anomalies and filter them to Active, Past, or Resolved:

• Active: An anomaly is Active if anomalous costs occurred in the last day (the last full day of cost data, which is often 2-3 days prior).
• Past: If an anomaly lasts more than 7 days, or the algorithm detects that costs are no longer anomalous, the anomaly is moved to the Past tab. Past anomalies can be useful to report on, but are often less urgent and actionable.
• Resolved: If you resolve an anomaly, the anomaly can be found in the Resolved tab.

Each anomaly explains how much more costs were than expected for the service name (ex:rds), usage type, and cloud accounts for the anomaly. The anomaly also shows what expected costs would have been in the time frame. The card also shows a graph with the cost trend over the past 1 month.

Anomalies with the most unexpected costs are at the top, so that it is easier to take action on anomalies with the most impact first.

This is an example of the list of anomalies detected in your infrastructure:

Take action on anomalies

Click an anomaly to view the services, teams, environments, and resource IDs that may be driving the cost anomaly.

Investigate the anomaly further, and by any additional dimensions, by viewing the costs in Explorer or saving the query to a Notebook. You can also send the anomaly, Explorer link, or Notebook to the associated service owners or teams. This enables teams to provide context for why the anomaly occurred, and if it’s expected.

You can also create a cost anomaly monitor to get alerted of similar cost anomalies in the future.

This is the side panel where you can take action on your cost anomaly:

Resolve anomalies

As you investigate anomalies, you may find anomalies that are not significant, were actually expected costs, or are otherwise not considered an anomaly.

Mark anomalies as significant or insignificant to give feedback and help improve the anomaly detection algorithm. Resolve anomalies with context to move anomalies to the Resolved tab, and add context for others in your organization.

This is an example of how to mark a cost anomaly as significant and explain why it’s an anomaly: