Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: A monitoring system is configured to distinguish between two types of alert rules— namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for machine learning-based techniques for reducing the visual complexity of a dependency graph that is representative of an application or service. For example, the dependency graph is generated that comprises a plurality of nodes and edges. Each node represents a compute resource (e.g., a microservice) of the application or service. Each edge represents a dependency between nodes coupled thereto. A machine learning-based classification model analyzes each of the nodes to determine a likelihood that each of the nodes is a problematic compute resource. For instance, the classification model may output a score indicative of the likelihood that a particular compute resource is problematic. The nodes and/or edges having a score that exceed a predetermined threshold are provided focus via the dependency graph.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: A monitoring system is configured to distinguish between two types of alert rules—namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: A computer platform for hosting applications utilizes a computing device to manage seasonal performance metric alerts. The computer device may include a memory and at least one processor coupled to the memory. The computer device may collect a time series of an application performance metric for a period of less than two weeks. The computer device may determine a daily distributions each day within the period. The computer device may apply a radial basis function (RBF) kernel-based change point detection to the time series to determine that the daily distributions include a weekend time period that has a different daily distribution than a time period before or after the weekend time period. The computer device may adjust a baseline prediction of the metric for the weekend time period. The computer device may send an alert based on a deviation of a value of the metric from the adjusted baseline prediction.

Abstract: Exception period data is removed from time series data that may be used for anomaly detection or other purposes. A changed time segment detector is configured to detect pairs of change points in received time series data that define changed time segments. Each detected pair of change points includes start and end points of a corresponding changed time segment. A changed time segment clusterer is configured to cluster the changed time segments into an arranged set of changed time segment clusters. An exception period identifier is configured to identify a changed time segment cluster as an exception period based on heuristics. A time series data indicator is configured to remove time series data corresponding to the exception time period from the received time series data to generate cleaned time series data.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for machine learning-based techniques for reducing the visual complexity of a dependency graph that is representative of an application or service. For example, the dependency graph is generated that comprises a plurality of nodes and edges. Each node represents a compute resource (e.g., a microservice) of the application or service. Each edge represents a dependency between nodes coupled thereto. A machine learning-based classification model analyzes each of the nodes to determine a likelihood that each of the nodes is a problematic compute resource. For instance, the classification model may output a score indicative of the likelihood that a particular compute resource is problematic. The nodes and/or edges having a score that exceed a predetermined threshold are provided focus via the dependency graph.

Abstract: A monitoring system is configured to distinguish between two types of alert rules—namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: A computer platform for hosting applications utilizes a computing device to manage seasonal performance metric alerts. The computer device may include a memory and at least one processor coupled to the memory. The computer device may collect a time series of an application performance metric for a period of less than two weeks. The computer device may determine a daily distributions each day within the period. The computer device may apply a radial basis function (RBF) kernel-based change point detection to the time series to determine that the daily distributions include a weekend time period that has a different daily distribution than a time period before or after the weekend time period. The computer device may adjust a baseline prediction of the metric for the weekend time period. The computer device may send an alert based on a deviation of a value of the metric from the adjusted baseline prediction.

Abstract: Examples described herein generally relate to alerting metric baseline behavior change. The examples include performing at least one of a radial basis function (RBF) kernel procedure and an autoencoding procedure for a time-series data; determining whether one or more change points occur in a seasonal pattern of the time-series data based on at least one of the RBF kernel procedure and the autoencoding procedure; and transmitting, to a user, an alert indicating the one or more change points based on a determination that the one or more change points occur in the seasonal pattern of the time-series data.

Abstract: Embodiments described herein provide dynamic thresholds for alerting users of anomalous resource usage of computing resources. The dynamic thresholds are based on the historical behavior of compute metrics (or a time series obtained therefor) associated with the computing resources and a detected seasonality in that time series. Based on characteristics of the time series, a model for generating dynamic thresholds is determined. The dynamic thresholds track the detected seasonality of the compute metrics. As utilization of the computing resources continue, the determined thresholds are applied to the compute metrics. If the determined thresholds are exceeded, an alert indicating an anomalous resource usage is provided to a user. The dynamic threshold may be adjusted (e.g., tightened or relaxed) based on a confidence level of the detected seasonality. This advantageously reduces the number of false alerts.

Abstract: Embodiments described herein provide dynamic thresholds for alerting users of anomalous resource usage of computing resources. The dynamic thresholds are based on the historical behavior of compute metrics (or a time series obtained therefor) associated with the computing resources and a detected seasonality in that time series. Based on characteristics of the time series, a model for generating dynamic thresholds that track the seasonality is determined. As utilization of the computing resources continue, the determined thresholds are applied to the compute metrics to determine whether the thresholds are exceeded. An alert indicating an anomalous resource usage is provided to a user if a threshold is exceeded. The dynamic thresholds are smoothed to reduce noise included therein in a manner in which the metric being monitored is not lost. The smoothed dynamic threshold(s) are clearer and simpler to understand to the end user and also reduce the number of noise-related alerts.