v0.33.0

Five new anomaly detectors, composite hot/big-key ranking, richer OTLP telemetry, and an ACL false-negative fix.

This release is heavy on detection. It adds five anomaly detectors targeting silent, non-self-healing cluster and client-buffer conditions, a new diagnostic that surfaces "hot and big" keys, a SCAN hash-skew advisory, and completes the OTLP mirroring work so OTel-only deployments get full telemetry.

✨ New anomaly detectors

• Client-eviction storms (EVICTED_CLIENTS) - warns when Valkey/Redis is evicting clients to reclaim client-buffer memory (maxmemory-clients). These disconnects were previously silent. Feeds the per-poll delta of the lifetime evicted_clients counter to a spike detector, absorbs counter resets on restart, and skips entirely when eviction is disabled (maxmemory-clients=0). The alert surfaces the limit and post-eviction client-buffer memory, with an explicit caveat that a single snapshot can't separate a justified eviction from an over-aggressive one - pointing the operator to the recurrence pattern instead. (upstream valkey#4151)

• Replicas stuck in slot migrating/importing state - after a reshard, some replicas silently keep reporting slots as migrating/importing (or wrongly owning slots) in CLUSTER NODES; the only fix is an operator running CLUSTER SETSLOT <slot> STABLE. Two-layer detection (node-local markers, refined by a CLUSTER SHARDS role-authority cross-view to suppress mid-promotion false positives), fanned out per-node so a replica polled only through the primary is still seen. Auto-resolves on recovery. (upstream valkey#1664)

• Gossip-mode failover churn - detects a single shard re-electing repeatedly within a 60s window (3+ epoch bumps or owner flips), the signature of competing FAILOVER coordinators. WARNING, escalating to CRITICAL across a second window, with a deterministic equal-epoch tiebreak and resharding suppression. (upstream valkey#3996)

• Replication output-buffer (COB) pressure - per-replica client-output-buffer ratio alerts with escalation-only hysteresis (60% warn / 90% critical of the slave hard limit), soft-limit sustained early warning, and a mem_clients_slaves aggregate fallback. Includes resync-loop detection and per-replica Prometheus buffer-pressure gauges. (upstream valkey#3963)

• Control-plane saturation (correlated) - flags a sustained ≥90% CPU streak paired with control-plane impact evidence: probe-RTT spike vs rolling baseline, graded replica drops, or recent control-plane anomalies (including failover churn). Emits one synthetic CRITICAL CPU event per episode, with restart-safe streak/baseline resets. (upstream valkey#3927)

📊 New diagnostics

• Composite multi-dimensional hot/big-key detection - the existing lists rank each dimension alone; this surfaces the key that is extreme on more than one at once - the "hot big key" (a large collection that's also hammered, or a hot key whose value quietly grew huge). Pure post-processing over the data already gathered in one scan (no extra round-trips), ranking on the two globally-retained signals (hotness + cardinality), with idle-recency fallback for hotness on non-LFU policies. New GET /key-analytics/composite-keys endpoint. (upstream valkey#4189)

• SCAN large-reply hash-skew advisory - a pure analyzer over stored large-reply entries that flags SCAN-family commands returning disproportionate bytes-per-requested-element (a sign of hash skew / degenerate chains), with worst-first ranking and per-offender remediation copy that distinguishes keyed-scan vs keyspace guidance. Surfaced on the SlowLog large-reply tab; hidden when there are no offenders. New GET /commandlog-analytics/scan-skew endpoint. (upstream valkey#3955)

📡 OpenTelemetry

• Unit metadata + webhook-independent OTLP mirroring - the OTLP exporter now derives UCUM units from metric-name suffixes (_bytes → By, _seconds → s, _ratio → 1, _percent → %, …) and carries them as OTLP metadata without rewriting metric names. Anomaly dispatch, cluster.failover, and instance.down/instance.up availability edges are decoupled from the Pro webhook gate, so an OTLP-only deployment (collector configured, no webhook) now receives complete telemetry. (upstream valkey#4078)

🐛 Fixes

• ACL: explicit command denials no longer read as an unrestricted grant. A default user with +@all followed by command denials (-@transaction, -exec, -multi) can still lose writes on AOF reload. The evaluator no longer treats such grants as the safe workaround - any deny token in the effective command rules now defeats the unrestricted claim (deny-wins, matching the ACL checker). (related to upstream valkey#3983)

🔧 Maintenance

• Bumped esbuild (0.27.4 → 0.28.1) and tsx (4.21.0 → 4.23.1) in the agent-cache Anthropic example.

⬆ Upgrade notes

• Fully backwards compatible - no config or schema migrations. New detectors and endpoints are additive; the composite key-analytics signal reuses existing hot_key_stats columns (no migration).
• New anomaly detectors emit over the existing webhook + OTLP channels automatically. OTLP remains opt-in via OTEL_* and is now independent of any webhook configuration.
• Docker: betterdb/monitor:0.33.0

What's Changed

• feat(anomaly): detect client-eviction storms (maxmemory-clients) by @KIvanow in #334
• feat(otel): unit metadata + decouple OTLP event mirroring from the webhook by @KIvanow in #335
• feat(key-analytics): composite multi-dimensional hot/big-key detection by @KIvanow in #336
• feat(anomaly): detect replicas stuck in slot migrating/importing state (valkey#1664) by @KIvanow in #344
• chore(deps): bump esbuild and tsx in /packages/agent-cache/examples/anthropic by @dependabot[bot] in #343
• fix(monitor): explicit ACL denials defeat the +@ALL workaround grant by @jamby77 in #345
• feat(anomaly): gossip-mode failover-churn detector (valkey#3996) by @jamby77 in #346
• feat(commandlog): SCAN large-reply hash-skew advisory (valkey#3955) by @jamby77 in #338
• feat(anomaly): replication output-buffer pressure detector (valkey#3963) by @jamby77 in #347
• feat(anomaly): control-plane saturation correlated detector (valkey#3927) by @jamby77 in #348

Full Changelog: v0.32.0...v0.33.0