Abstract: Examining time series sequences representing performance counters from executing programs can provide significant clues about potential malfunctions, busy periods in terms of traffic on networks, intensive processing cycles and so on. An unsupervised anomaly detector can detect anomalies for any time series. A combination of known techniques from statistics, signal processing and machine learning can be used to identify outliers on unsupervised data, and to capture anomalies like edge detection, spike detection, and pattern error anomalies. Boolean and probabilistic results concerning whether an anomaly was detected can be provided.

Abstract: An event monitoring system that includes two stages, an event sorting stage and an event processing stage. The event sorting stage receives events provided by at least one application, and includes multiple event sorting systems. The event processing stage includes at least one event processing system that processes events forwarded by the event sorting stage. The event processing system(s) is/are capable of processing events that fall within a particular set of one or more context partitions that correspond to the respective event processing system. As the event sorting system receives an event, the event sorting system identifies which context partition the event falls within. The event sorting system then identifies the event processing system that corresponds to the identified context partition of the event, and then forwards the event to the identified event processing system. The event processing system then applies the set of one or more monitoring rules.

Abstract: Examining time series sequences representing performance counters from executing programs can provide significant clues about potential malfunctions, busy periods in terms of traffic on networks, intensive processing cycles and so on. An unsupervised anomaly detector can detect anomalies for any time series. A combination of known techniques from statistics, signal processing and machine learning can be used to identify outliers on unsupervised data, and to capture anomalies like edge detection, spike detection, and pattern error anomalies. Boolean and probabilistic results concerning whether an anomaly was detected can be provided.

Abstract: An event monitoring system that includes two stages, an event sorting stage and an event processing stage. The event sorting stage receives events provided by at least one application, and includes multiple event sorting systems. The event processing stage includes at least one event processing system that processes events forwarded by the event sorting stage. The event processing system(s) is/are capable of processing events that fall within a particular set of one or more context partitions that correspond to the respective event processing system. As the event sorting system receives an event, the event sorting system identifies which context partition the event falls within. The event sorting system then identifies the event processing system that corresponds to the identified context partition of the event, and then forwards the event to the identified event processing system. The event processing system then applies the set of one or more monitoring rules.

Abstract: One embodiment of the invention uses templates that define certain features of a given service type, wherein the features are common to all services of that service type. The template can be configured by a user to obtain a service definition for the given service. The service definition is passed to a programmability layer and provides enough information that the programmability layer can construct the various monitors, rules, classes and tasks required to monitor the given service without further customization by the user. In one embodiment, the user can also customize the service definition, a desired, in order to obtain additional monitoring.

Abstract: One embodiment of the invention uses templates that define certain features of a given service type, wherein the features are common to all services of that service type. The template can be configured by a user to obtain a service definition for the given service. The service definition is passed to a programmability layer and provides enough information that the programmability layer can construct the various monitors, rules, classes and tasks required to monitor the given service without further customization by the user. In one embodiment, the user can also customize the service definition, a desired, in order to obtain additional monitoring.