The log anomaly analysis algorithm starts to run when an intelligent inspection job is created. The algorithm model must be trained for a specific period of time before the algorithm model can detect anomalies. This period of time is called the initialization time for the algorithm model. You can configure the number of time windows and the length of the time windows to specify the initialization time.
If you specify appropriate initialization time, the algorithm model can analyze the logs of most categories in the initialization phase to better detect anomalies. In most cases, logs are generated at regular intervals. Therefore, the initialization time must be equivalent to the interval during which logs are generated, or 50% or 25% of the interval to ensure that the algorithm model can analyze the logs of most categories in the initialization phase.
If the initialization time cannot be determined, you can retain the default value of the Initialization Windows parameter or specify a random value for this parameter. After the initialization phase, the algorithm model adapts to new data and is updated. The optimization of the algorithm model is performed regardless of the duration of the initialization time.
If the initialization time is short, a large number of anomalous events may occur in the early stage of the job. However, the detection of anomalous events in the long term is not affected.