Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Techniques for efficiently generating aggregate distribution approximations are disclosed. In some embodiments, a system receives a plurality of piecewise approximations that represent different distributions of a set of values on at least one computing resource. Based on the plurality of piecewise approximations, a set of clusters are generated, within volatile or non-volatile memory, that approximate an aggregate distribution of the set of metric values on the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to an aggregate piecewise approximation of a function for the set of metric values on the at least one computing resource.

Abstract: Techniques for generating distribution approximations with low memory footprints are disclosed. In some embodiments, a system receives a first set of values that measure one or more metrics of at least one computing resource. A set of clusters are generated, within volatile or non-volatile memory, that approximate a distribution of the first set of values measuring the one or more metrics of the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to a piecewise approximation of a function for the first set of values.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Techniques are disclosed for summarizing, diagnosing, and correcting the cause of anomalous behavior in computing systems. In some embodiments, a system identifies a plurality of time series that track different metrics over time for a set of one or more computing resources. The system detects a first set of anomalies in a first time series that tracks a first metric and assigns a different respective range of time to each anomaly. The system determines whether the respective range of time assigned to an anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series. The system generates at least one cluster that groups metrics based on how many anomalies have respective ranges of time and/or timestamps that overlap. The system may preform, based on the cluster, one or more automated actions for diagnosing or correcting a cause of anomalous behavior.

Abstract: Techniques are disclosed for summarizing, diagnosing, and correcting the cause of anomalous behavior in computing systems. In some embodiments, a system identifies a plurality of time series that track different metrics over time for a set of one or more computing resources. The system detects a first set of anomalies in a first time series that tracks a first metric and assigns a different respective range of time to each anomaly. The system determines whether the respective range of time assigned to an anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series. The system generates at least one cluster that groups metrics based on how many anomalies have respective ranges of time and/or timestamps that overlap. The system may preform, based on the cluster, one or more automated actions for diagnosing or correcting a cause of anomalous behavior.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Techniques for efficiently generating aggregate distribution approximations are disclosed. In some embodiments, a system receives a plurality of piecewise approximations that represent different distributions of a set of values on at least one computing resource. Based on the plurality of piecewise approximations, a set of clusters are generated, within volatile or non-volatile memory, that approximate an aggregate distribution of the set of metric values on the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to an aggregate piecewise approximation of a function for the set of metric values on the at least one computing resource.

Abstract: Techniques for generating distribution approximations with low memory footprints are disclosed. In some embodiments, a system receives a first set of values that measure one or more metrics of at least one computing resource. A set of clusters are generated, within volatile or non-volatile memory, that approximate a distribution of the first set of values measuring the one or more metrics of the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to a piecewise approximation of a function for the first set of values.