| No monitor has prediction enabled yet |
No monitor has Enable switched on, or the list is not refreshed yet. |
Enable prediction on a monitor, then Run predictions now (the list is otherwise refreshed every 10 minutes). |
| Model Queued for long |
The service trains one model at a time; others wait their turn. |
Wait. The service’s /health shows the queue length. |
| Model Failed, hover shows The training query returned no data |
InfluxDB holds nothing for this monitor: the Integrator does not write to InfluxDB, or not to the database / bucket the service reads. |
Check the Integrator’s InfluxDB output and the service’s INFLUXDB_* variables. Training is retried after 24 hours, or use Train now. |
| Model Failed, hover shows Not enough history to train: N usable checks, at least 138 needed |
Too little history (a new monitor, or one that mostly fails). |
Wait for more successful checks; training is retried every 24 hours. |
| Model Failed, hover shows Query would scan 432 Parquet files, exceeding the file limit |
InfluxDB 3 Core’s 72-hour limit per query, with a prediction service before 1.5. |
Upgrade the prediction service to 1.5 or later, which reads the history in slices. |
| Forecast reads No new check since … |
The newest check the service found is older than three of the monitor’s schedules: the monitor or its probe stopped, or the Integrator no longer writes to InfluxDB. The forecast is not current and raises no alert. |
Check the monitor, its probe and the Integrator’s InfluxDB output. It clears at the next forecast once checks arrive. |
| Forecast UNKNOWN with status 503 now and then |
The service refused the connection: PREDICTION_MAX_CONNECTIONS too low (services before 1.5 were fixed at 10). |
Upgrade the service, or raise PREDICTION_MAX_CONNECTIONS. |
| Forecast UNKNOWN with status 502 … InfluxDB file limit |
A forecast query hit InfluxDB 3 Core’s file limit even in its smallest slice (15 minutes): an unusually dense measurement. |
Raise --query-file-limit on InfluxDB, or lower PREDICTION_LOOKBACK_DAYS. |
| No ranges on the chart |
The model was trained before service 1.5 (it is retrained once, within the hour), it is an LSTM model, or the history is too short to measure them. |
Wait for the retraining, or Train now. |
| Its behaviour changed recently: the range is narrower than it should be |
Under 70 % of the monitor’s recent checks fell in its 80 % range. |
Train now after a lasting change; it is otherwise retrained weekly. |
| Waiting for a model |
Normal until the first training ends. |
|
| Forecast UNKNOWN with status 400 … Insufficient data |
Fewer recent successful checks than the model needs (60). |
The monitor has been failing or paused; forecasts resume with enough successful checks. |
| Forecast reads No forecast alert: … |
The monitor’s history does not announce its breaches well enough for a warning to be trusted; the end of the line says why (no threshold, not enough history, too few past breaches, no warning signs, too often wrong). See Breach risk. |
Usually nothing to fix: these breaches come without warning, and anomaly alerts still work. Without thresholds, set minor / major / critical thresholds on the monitor. |
| Forecast reads Forecast alerts paused: retraining |
The thresholds or the prediction count changed since the model was trained. |
Nothing: the model retrains at the next forecast. With Manual training only, use Train now. |
| Forecast always OK |
The breach risk stays under the monitor’s cut. |
Normal for a healthy monitor. The hover shows how often warnings were right on its history. |
| Forecast flat or far off |
Very little or very irregular history, or a recent change of behaviour. |
Train now after the change; check the model’s error (column Trained). |
| A monitor is missing from the table |
Its probe did not answer the last refresh, or the monitor type is not forecast (EUM, SNMP, WMI, log, directory). |
Check the probe. A probe that does not answer keeps its previous monitors in the list. |