Spotting Traffic Shifts Before They Become Outages
HTTP error rate alerts tell you when end users are hitting problems. But some of the most damaging issues never produce an error page — they show up as a sudden drop in requests, or an unexpected surge. A broken link on a major referrer can silently bleed revenue for hours; a misconfigured firewall rule can flood your origin with malicious traffic disguised as a spike.
Cloudflare's new Traffic Anomalies notifications, available to Enterprise customers, are designed to catch those shifts. The system monitors overall HTTP traffic and alerts when it detects statistically significant deviations from normal patterns — for both spikes and drops.
Why Thresholds Aren't Enough
Simple thresholds work for HTTP errors because the baseline is close to zero: any spike is abnormal by definition. Overall traffic is different. Every site has natural rhythms — lunchtime surges, overnight lulls, weekly seasonality — that make fixed thresholds either noisy or useless.
Traffic patterns behave more like Cloudflare's Security Events monitoring, which also deals with fluctuating baselines. For that reason, Traffic Anomalies uses the same z-score calculation already proven in Security Event alerting. The current value is compared against a historical average; the distance from that average, measured in standard deviations, determines whether an alert fires.
The short window is the past 5 minutes of traffic, compared against a 4-hour rolling average. A positive z-score signals a spike; a negative one signals a drop. When the current value moves more than 3.5 standard deviations from the mean, Cloudflare sends an alert. Measurements run every 5 minutes, so anomalies are caught quickly.
Filtering Out the Noise
Unlike Security Events — where a drop is almost always good news — Traffic Anomalies alerts on both directions. A traffic collapse is usually a problem worth investigating, and a surge could be either a promotion gone viral or an attack. Administrators need to know either way.
To avoid alert fatigue, the system includes minimum thresholds. Even if traffic strays beyond 3.5 standard deviations, no alert fires unless the change is meaningful: spikes must exceed 200 requests, and drops must fall by at least 200 requests. This keeps notifications focused on real incidents rather than statistical artifacts.
Under the Hood
Cloudflare already stores sampled HTTP request statistics in ClickHouse. Every minute, that data is pulled into VictoriaMetrics, a time-series database chosen for three specific reasons:
- Low operational overhead: The team wanted minimal configuration burden, and VictoriaMetrics delivers.
- Horizontal scaling: It can run in a highly available mode, which matters for a system delivering time-sensitive alerts.
- Efficiency: In testing, VictoriaMetrics consumed roughly one-third the memory of Prometheus for the same workload.
Once metrics are in VictoriaMetrics, queries determine whether customer alert conditions are met. Delivery then goes through Cloudflare's existing Alert Notification System, the same infrastructure used for other notification types since 2019.
Configuration Options
Setting up a Traffic Anomalies notification starts in the Notifications tab of the dashboard, where you can name the alert and choose delivery channels alongside all other Cloudflare notification types.
From there, the configuration offers granular control:
- Domains: Select which zones to monitor.
- Mitigated traffic: Choose whether to include requests already blocked by Cloudflare's DoS or WAF products.
- Status codes: Include or exclude specific HTTP response codes from the analysis.
- Direction: Alert on traffic spikes, drops, or both.
Traffic Anomalies are now available to Enterprise customers directly from the Notifications tab in the Cloudflare dashboard.
