Driftwatch · signal map

Tickets don't arrive alone. When a rack loses power you get unreachable, PSU lost and fan critical together; a failing drive brings SMART warning and backup failed. This page treats each normalized ticket subject as a signal, measures which signals co-occur on the same host in the same hour, and colours each relationship (edge) on a topographic scale — deep blue for weak, through green and yellow, to brown and white peaks for the strongest.

1 · Three measures, one picture

For two signals X and Y, define each as a binary variable per host-hour: “did a ticket with this template fire?”. Then:

Joint entropy H(X,Y)

H(X,Y) = −Σ p(x,y)·log₂ p(x,y)

Total uncertainty of the pair. Large when both signals are common and active, even if they're unrelated. Good for "what is busy"; bad for "what is related".

Conditional entropy H(Y|X)

H(Y|X) = H(X,Y) − H(X)

Uncertainty left in Y once you know X. Asymmetric: the matrix view shows every ordered pair. Low = X nearly determines Y. The “remaining” variant divides by H(Y): 1.0 means X tells you nothing.

Mutual information I(X;Y)

I(X;Y) = H(X)+H(Y) − H(X,Y)

Shared information: how many bits knowing one signal saves on the other. Zero for independent signals, symmetric, and the cleanest "these belong together" score.

Why it matters for drift: when a new underlying cause appears, new edges light up between signals that never co-occurred before. Switch to Δ MI vs baseline after enabling the NIC-firmware cause below.

2 · The map

Simulated fleet sample: each unit is one host-hour. Hidden causes (power loss, disk filling, thermal…) fire at random and trigger sets of signals, on top of independent background noise. The graph never sees the causes: it recovers structure purely from co-occurrence.

View: Edges shown (top %)

Strongest relationships (current measure)

3 · Experiment

Toggle the hidden causes and watch edges appear and vanish. Shrink the sample and see spurious edges appear from sampling noise — the same reason you calibrate thresholds on healthy history.

Host-hours sampled

4 · Reading it

Cluster = shared cause. Tightly linked signals (e.g. unreachable · PSU · fan) usually trace to one physical or software cause. Open a ticket for the cause, not for each signal.
Joint vs mutual. Pick “Joint entropy” and the busiest signals glow regardless of relatedness; switch to “Mutual information” and only genuinely coupled pairs remain. That contrast is the whole point of subtracting H(X)+H(Y).
Asymmetry shows direction of explanation. In the matrix, if backup-fail given disk-full is much lower than the reverse, disk-full is a strong predictor of backup failures but not every failed backup is a disk problem.
Topographic colour scale. Every edge is coloured by its value on a hypsometric (elevation-style) palette: low ground is blue, then green and yellow, and the highest ridges are brown and white. A node where several warm edges meet is a hub worth investigating first.
Unit of co-occurrence matters. Host-hour finds same-machine coupling. Use rack-hour for shared-infrastructure causes, or cluster-hour for software rollouts.