Mugnsoft logo Mugnsoft
Changelog

Predictive Analytics release notes

Detailed information about every release of the Predictive Analytics service — the Mugnsoft Core add-on that forecasts each monitor's next checks, estimates the risk of a threshold breach and flags anomalies. Its version stream (1.x) is its own, not Core's: see the Core release notes. For installation, see the quick start.

v1.4.0

latest

v1.4.0 is the first release of the prediction service published on this site. The service now owns its data and its training: the webserver names a monitor, the service reads its history from its own InfluxDB, trains its own models and answers a forecast, a breach risk and an anomaly score — only to requests the webserver has signed. Read Before you upgrade first: the service refuses to start without caller authentication.

⬢ Before you upgrade

  • Caller authentication is required. The service refuses to start until it can authenticate its callers. Copy the public key from Settings > Webserver > Predictive Analytics into a file, point PREDICTION_JWT_PUBLIC_KEY at it and set PREDICTION_REQUIRE_JWT=true. PREDICTION_API_KEY still works while PREDICTION_REQUIRE_JWT is off.
  • The service queries its own InfluxDB. Put the connection in the INFLUXDB_* settings of its .env. Queries, URLs and tokens sent by a caller are refused unless PREDICTION_ALLOW_CLIENT_BACKEND=true — leave it off: that legacy mode lets anyone holding the API key make the service connect anywhere.
  • Earlier models keep working. Network (LSTM) models answer no breach risk, and the webserver falls back to the threshold-crossing forecast for them. Retrain a monitor with the median engine to get the breach risk.

＋ New features

  • Median engine, the new default. The forecast is the median of the latest checks, and the anomaly score compares the latest check with the median before it. On the history of 65 real monitors its error was 0.73× that of repeating the last check, it beat that forecast on 98% of them and caught 94% of injected spikes at 2.8% false alarms. A model trains in seconds, without TensorFlow. The Conv1D-LSTM network stays available (PREDICTION_ENGINE=lstm).
  • Breach risk. Instead of waiting for the forecast to cross a threshold, each model learns how likely a breach is within the next checks, and is only trusted when that holds on data it was not trained on. Out of sample, on 65 real monitors, it switched on for 14, with 55% precision, and warned ahead of 30% of their breaches — against 2% for the threshold crossing. Most response-time breaches remain sudden shocks.
  • The service trains its own models. The webserver queues training for monitors without a model, retries failures after a day and retrains on the period set in its settings. Jobs run one at a time, and a new model replaces the old one atomically; the previous files are kept, and the state survives restarts.
  • Requests signed by the webserver. RS256 tokens valid five minutes, with a key pair kept for this link. The key file may hold several keys during a rotation and is reloaded when it changes. Pin the service certificate in the webserver settings (Fetch certificate): a self-signed certificate is then fine.
  • Linux, Windows and Docker. Archives for Linux x86-64 (glibc 2.28 or later) and Windows 64 bit, and a Docker image running as a non-root user. An optional training CLI ships as its own archive. See the download page and the quick start.

▲ Improvements

  • A /health endpoint, reachable without credentials, for supervisors and container health checks.
  • Error responses never carry internal details: they are logged on the service and answered with a generic message.