Frozen dataclass targeting FD leaks and pool collapses. Spike mode is elevated to error because leaked descriptors usually mean resource exhaustion is near.

  • Ceiling — max_fds is an absolute FD cap (a soft pre-ulimit tripwire). Severity error.
  • Spike — spike_ratio + min_spike_delta detect leaks. Severity error.
  • Drop — drop_ratio + min_drop_delta catch pool collapse. Severity warning.

All integer deltas here (min_spike_delta / min_drop_delta) are counts of file descriptors.

Fields

NameTypeDescriptionDefault
durationstr | intShort evaluation window."5m"
baseline_durationstr | intBaseline window."1h"
max_fdsint | NoneAbsolute FD ceiling. None disables ceiling mode.800
spike_ratiofloat | NoneGrowth factor vs. baseline.1.5
min_spike_deltaint | NoneFD delta floor for a spike.50
drop_ratiofloat | NoneDecline factor in (0, 1).0.5
min_drop_deltaint | NoneFD delta floor for a drop.50

Computed properties: duration_sec, baseline_duration_sec.

Example

import snitchbot
from snitchbot import AnomalyConfig, FdAnomalyConfig

snitchbot.init(
    "proxy-gateway",
    anomaly=AnomalyConfig(
        fds=FdAnomalyConfig(
            max_fds=4096,
            spike_ratio=1.3,
            min_spike_delta=100,
        ),
    ),
)

Telegram shows:

🔴 anomaly · proxy-gateway · 91e7da
FD leak: 842 -> 1240 (+398)
Details
  time      11:24:55 UTC
  pid       1550
  type      fds_spike
  window    5m
  baseline  842
  current   1240

Notes

Pass fds=None to AnomalyConfig to disable the whole detector rather than tuning each mode off.