Explainable Anomaly Detection for Container-Based Odoo/PostgreSQL Microservices

Modern enterprise systems rely on containerized microservice architectures where anomalies can propagate across multiple layers, making detection and diagnosis challenging. Existing approaches focus on runtime telemetry while ignoring deployment and configuration context from Infrastructure-as-Code (IaC) tools. This thesis designs and evaluates a four-layer explainability system for anomaly detection in a containerized Odoo 16 and PostgreSQL 15 environment, integrating Zabbix metrics, OpenSearch logs, and IaC records from Terraform and Ansible. The system combines Isolation Forest and Autoencoder models for metric-based detection with SHAP attribution, Drain-based log template extraction, and a weighted multimodal fusion stage. Each detected anomaly produces a composed explanation covering metric attribution, log-pattern evidence, trace-path localization, and IaC deployment context. Evaluation combines six controlled fault injection scenarios with real production telemetry from Codebeex. The IaC explanation layer achieved 100% consistency across all evaluated scenarios. Multimodal fusion outperformed single-modality detection for four of six injections. Composed explanations achieved 100% correctness and specificity and 83% actionability across six production anomaly types. Notably, five of six naturally occurring production anomaly types are detectable exclusively through application-level log analysis, confirming that proxy-layer monitoring alone is insufficient in production Odoo environments.