Abstract: Techniques are described for an anomaly detection service for metric data collected by a data monitoring service of a service provider network. The anomaly detection service provides various graphical user interfaces (GUIs), public application programming interfaces (APIs), and other interfaces that enable users to specify metric data of interest to the user and for which the user desires the service to detect occurrences of anomalies. The selected metric data generally can correspond to any type of time series data collected by the data monitoring service and to which a user has access. Example types of metric data that can be monitored by an anomaly detection service include, but are not limited to, operational data generated by various components of a computer system, business data generated by various types of applications, and the like.

Abstract: A method includes obtaining time series data for a usage or performance metric for computing resources in a service provider network comprising a plurality of observations recorded in a plurality of respective time steps. A prediction error is determined for a previous prediction of an observation in the time series data. The prediction error is used to update a standard deviation of a set of predication errors for the usage or performance metric. The standard deviation and the prediction error are then used to update a confidence coefficient. A prediction limit for the usage or performance metric is then determined based on an expected value, the confidence coefficient, and the standard deviation. One or more events may be generated based on the prediction limit, which may be used to trigger a reconfiguration or auto-scaling of the computing resources.

Abstract: A computing resource monitoring service obtains access to aggregated metrics data from computing resources of a computing resource service provider. The computing resource monitoring service may then generate a predictive model based at least in part on the aggregated metrics. The predictive model may then be used to generate a prediction associated with the computing resource and, based at least in part on the prediction, one or more alarms may be triggered. The alarm may be triggered based at least in part on a confidence interval determined based at least in part on the prediction.