Abstract: Systems and methods for clustering metrics for reducing a search space of metrics used for service health analyses. Determining a root cause of an event includes performing an automated analysis of metrics associated with the service. To diagnose and resolve events quickly and efficiently, aspects correlate and cluster a plurality of metrics for a specific service based on historical data, where each cluster represents a root cause direction. After clustering metrics by similarity, metrics are scored and ranked to select representative metrics from each cluster, which reduces the dimensionality of the search space. The representative metrics may provide a saliant representation of each metrics cluster. The representative metrics are provided to a service health analyzer, which performs a root cause analysis of the representative metrics to diagnose and mitigate the event.

Abstract: The techniques disclosed herein enable a system to perform a robust evaluation of resource requirement recommendations through a simulated computing environment that closely resembles current conditions of a live computing environment. To achieve this, system characteristics such as CPU, RAM, and storage are extracted from currently available computing resources at the live computing environment. In addition, active software deployments at the live computing environment are randomly sampled to generate an activity dataset. The system characteristics and the activity dataset are then used to generate the simulated computing environment. Instances of a pending software deployment are then assigned to the simulated computing environment according to a resource requirement recommendation. The instances are then executed across various scenarios and analyzed to calculate a level of resource utilization.

Abstract: Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

Abstract: A monitoring system is configured to distinguish between two types of alert rules— namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: Operational metrics of a distributed collection of servers in a cloud environment are analyzed by a service to intelligently machine learn which operational metric is highly correlated to incidents or failures in the cloud environment. To do so, metric values of the operational metrics are analyzed over time by the service to check whether the operation metrics exceed a particular metric threshold. If so, the service also checks whether such spikes in the operation metric above the metric thresholds occurred during known cloud incidents. Statistics are calculated reflecting the number of times the operational metrics spiked during times of cloud incidents and spiked during times without cloud incidents. Correlation scores based on these statistics are calculated and used to select the correlated operational metrics that are most correlated to cloud failures.

Abstract: The techniques disclosed herein enable systems to efficiently allocate computing resources for various computing workloads through a shared peak resource usage prediction. To achieve this, a predictive model analyzes a historical dataset defining resource usage of a computing environment for a past timeframe, and calculates a peak environment resource usage for a future or current timeframe. In addition, the predictive model estimates a peak number of computing workloads for the computing environment. Using the peak resource usage and/or the peak number of computing workloads, the system derives resource requests for allocating computing resources to a plurality of computing workloads. The computing workloads are subsequently assigned to computing nodes within the computing environment for execution. Furthermore, computing workloads within a computing node are configured to share computing resources to accommodate sudden surges in demand.

Abstract: The techniques disclosed herein enable a system to perform a robust evaluation of resource requirement recommendations through a simulated computing environment that closely resembles current conditions of a live computing environment. To achieve this, system characteristics such as CPU, RAM, and storage are extracted from currently available computing resources at the live computing environment. In addition, active software deployments at the live computing environment are randomly sampled to generate an activity dataset. The system characteristics and the activity dataset are then used to generate the simulated computing environment. Instances of a pending software deployment are then assigned to the simulated computing environment according to a resource requirement recommendation. The instances are then executed across various scenarios and analyzed to calculate a level of resource utilization.

Abstract: Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for machine learning-based techniques for reducing the visual complexity of a dependency graph that is representative of an application or service. For example, the dependency graph is generated that comprises a plurality of nodes and edges. Each node represents a compute resource (e.g., a microservice) of the application or service. Each edge represents a dependency between nodes coupled thereto. A machine learning-based classification model analyzes each of the nodes to determine a likelihood that each of the nodes is a problematic compute resource. For instance, the classification model may output a score indicative of the likelihood that a particular compute resource is problematic. The nodes and/or edges having a score that exceed a predetermined threshold are provided focus via the dependency graph.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: A monitoring system is configured to distinguish between two types of alert rules—namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: Example aspects include techniques for detecting, for one or more instances of a dependency call from a service to a dependency in the cloud computing platform, the one or more instances of the dependency call having a common set of dependency call inputs, that a value of a dependency call performance metric of the dependency call is outside of a threshold range, providing, to a machine learning (ML) model and based on detecting that the value is outside of the threshold range, the common set of dependency call inputs for the one or more instances of the dependency call, obtaining, from the ML model and based on the common set of dependency call inputs, an expected value for the dependency call performance metric, and determining, based on comparing the value to the expected value, the entity causing the value to be outside of the threshold range.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Example aspects include techniques for shifting left database degradation detection. These techniques may include identifying a database query in application code in a pre-production environment and predicting, via a prediction model corresponding to a production environment, a resource cost of the database query, the prediction model trained on database activity resulting from execution of a plurality of database queries over a production database system within the production environment. In addition, the techniques may include presenting, via a user interface, a notification corresponding to the resource cost.

Abstract: Example aspects include techniques for implementing resource governance in multi-tenant environment. These techniques may include receiving a service request for a multi-tenant service from a client device, and predicting a resource utilization value (RUV) resulting from execution of the service request based on text of the service request, an amount of data associated with the client device at the multi-tenant service, and/or a temporal execution value. In addition, the techniques may include determining that the RUV is greater than a preconfigured threshold identifying an expensive request, and applying a load balancing strategy to the service request based on the RUV being greater than the preconfigured threshold.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.