Anomaly History

What the History window is

Anomaly History is a calm place to look back at what Anomalous has already caught on your Mac — and, just as importantly, how each thing turned out. Open it from the menu-bar gear menu → “Anomaly History…”, or from Settings → General → Anomaly history. It opens on a dashboard, with a journal and a send-log a click away.

This is a review, not a live monitor. It does not show you what your Mac is doing this second the way Activity Monitor or iStat do — it shows you what Anomalous has already flagged, resolved, and filed away. That makes it good at three things a real-time graph cannot do: spot a process that keeps misbehaving over weeks, confirm that a fix you made actually held, and slowly teach you what is normal for your own machine.

The Overview dashboard

The Overview tab answers “what has my Mac been up to?” at a glance. Four stat tiles sit across the top: how many incidents there were, how many distinct processes were flagged (and how many of those keep coming back), the most common kind of anomaly, and the share that cleared on their own with no action needed from you.

Below the tiles are the charts. Incidents over time is a simple per-day bar chart, so a bad afternoon or a creeping trend is easy to see. What’s happening most breaks the same incidents down by type — runaway CPU, memory growth, and so on — coloured to match the app’s own safety semantics. How they resolved is a ring showing the outcome of every incident, with the self-cleared percentage in the middle. And Most-flagged processes lists the handful that tripped most often, each noting how many times it returned and when you last saw it — click any one to open its full story in By Process.

The By Process and Sent tabs

The By Process tab answers the question the dashboard raises: does this one program keep misbehaving, and did my fix hold? A searchable sidebar lists every process Anomalous has ever flagged — sort it by Most incidents, Most recent, or Name — and picking one opens its whole story on the right. You get a chart of that process’s incidents over time, coloured by type, and beneath it a timeline of every episode: what it was, when it happened, how long it ran, and how it cleared. If you tuned a setting or updated an app to calm it down, this is where you confirm the flags actually stopped. You can also land here in one click from the Overview’s most-flagged list.

The Sent tab is a different kind of record: it is the send-log, a byte-for-byte list of anything Anomalous has ever contributed off your Mac, shown exactly as it was sent. Most people’s Sent tab is nearly empty, because detection and judgment happen on-device; entries appear only when an anonymous discovery lookup or a Get Help request actually went out. It is the user-facing half of a two-ledger transparency system — you can open any entry and read the precise JSON that left, and it is designed to be diffable against the server’s copy. See privacy for the full promise.

Choosing a range

A range picker in the top-right of the dashboard scopes everything you see to Day, Week, Month, or Unlimited. Day and Week are for “what just happened”; Month is the sensible default for spotting a pattern; Unlimited reaches back across everything your history still holds. Change it and the tiles, charts, and process list all recompute together, so the whole page always describes one consistent window of time.

How much history to keep

You decide how deep the history goes. In Settings → General → Anomaly history, the “Keep the last” control offers 250, 1,000, 5,000, 25,000, or Unlimited incidents. The default is 1,000, which is plenty for most Macs. When you hit the limit, the oldest incidents are dropped to make room — so at the default, the dashboard is a rolling picture of recent history rather than an all-time archive. Raise it if you like keeping a long tail; there is no wrong answer.

Export or clear your history

Two buttons sit in the window’s toolbar. Export… saves your entire history as a CSV file wherever you choose — useful for keeping a longer record than your retention setting holds, or for opening the numbers in a spreadsheet. Clear… erases the local history after a confirmation, emptying every tab. Clearing removes only the record of what was caught: it does not touch detection or the baselines Anomalous has learned for your Mac, so it keeps watching exactly as before — you have cleared the logbook, not the guard.

Both are local. Export writes a file to a spot you pick and sends nothing anywhere; Clear simply deletes local data. Neither action puts anything on the network.

It never leaves your Mac

Your anomaly history is local, on-device, and yours. Every incident in it was detected and judged on your Mac, written to a local journal, and it is read straight back from that same file to build this window. Nothing about your history — not the incidents, not the counts, not the processes involved — is uploaded, synced, or sent anywhere. The one thing that ever does leave is what the Sent tab already shows you, in full.

Anomalous is open source, so you can read exactly how the history is stored and drawn: the sensor app lives at anomalous-mac, and the public process corpus at anomalous-corpus welcomes PRs. If something in the window looks off, the FAQ is a good next stop.