Costa Tsaousis spoke at OpenConf 2025, held November 21–22 at Dais Events in Athens. The talk, “Practical AI and Machine Learning for Observability in Netdata,” presented a specific framing of anomaly detection that Costa has been developing across multiple conferences: ML as an advisor, not just an alert trigger.
The distinction matters. Most ML-in-monitoring implementations boil down to “replace static thresholds with dynamic ones.” Netdata’s approach is different. Multiple independent ML models run on each node, each trained on a single metric’s behavior. When one model flags an anomaly, that is information but not necessarily action. When dozens of models across multiple services flag anomalies simultaneously, that convergence is a strong signal. The system acts as an advisor – surfacing unusual patterns, predicting potential failures, and detecting early signs of security breaches – rather than firing off yet another alert.
Costa walked through concrete examples: how coordinated anomaly scores helped uncover issues that no single threshold would have caught, and how this approach reduces false positives by requiring convergence rather than reacting to isolated deviations. OpenConf drew the Greek tech and open-source community, and the Q&A reflected an audience that was technically engaged and willing to push back on claims. A good room for an honest talk about what ML can and cannot do in production monitoring.
