Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

Abstract: A monitoring system is configured to distinguish between two types of alert rules— namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for machine learning-based techniques for reducing the visual complexity of a dependency graph that is representative of an application or service. For example, the dependency graph is generated that comprises a plurality of nodes and edges. Each node represents a compute resource (e.g., a microservice) of the application or service. Each edge represents a dependency between nodes coupled thereto. A machine learning-based classification model analyzes each of the nodes to determine a likelihood that each of the nodes is a problematic compute resource. For instance, the classification model may output a score indicative of the likelihood that a particular compute resource is problematic. The nodes and/or edges having a score that exceed a predetermined threshold are provided focus via the dependency graph.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: A monitoring system is configured to distinguish between two types of alert rules—namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: Example aspects include techniques for implementing peer group evaluation for comparative anomaly. These techniques may include determining a candidate group including a plurality of component metrics, and determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time. In addition, the techniques may include detecting anomalous activity based at least in part on first performance information of a component metric deviating from second performance information for the peer group, and providing a notification of the anomalous activity.

Abstract: Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Example aspects include techniques for implementing resource governance in multi-tenant environment. These techniques may include receiving a service request for a multi-tenant service from a client device, and predicting a resource utilization value (RUV) resulting from execution of the service request based on text of the service request, an amount of data associated with the client device at the multi-tenant service, and/or a temporal execution value. In addition, the techniques may include determining that the RUV is greater than a preconfigured threshold identifying an expensive request, and applying a load balancing strategy to the service request based on the RUV being greater than the preconfigured threshold.

Abstract: Example aspects include techniques for shifting left database degradation detection. These techniques may include identifying a database query in application code in a pre-production environment and predicting, via a prediction model corresponding to a production environment, a resource cost of the database query, the prediction model trained on database activity resulting from execution of a plurality of database queries over a production database system within the production environment. In addition, the techniques may include presenting, via a user interface, a notification corresponding to the resource cost.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: Methods for one click monitors in impact time detection for noise reduction in at-scale monitoring are performed by systems and devices. The methods automatically configure time window sizes and numbers of consecutive time windows for optimally detecting system alerts in at-scale systems and per dimension combinations, including updating settings over time to adapt to changing system behaviors. The past behavior of system performance metrics are analyzed to match configuration options and determine a best fitting or optimal combination of a highest detection accuracy in lowest time to detect for alerting. Optimal monitoring configurations are determined for each of up to hundreds of thousands of the metric dimensions across the system, and an end user is enabled to apply the determined, optimal configurations for system monitoring with a single selection.

Abstract: A computer platform for hosting applications utilizes a computing device to manage seasonal performance metric alerts. The computer device may include a memory and at least one processor coupled to the memory. The computer device may collect a time series of an application performance metric for a period of less than two weeks. The computer device may determine a daily distributions each day within the period. The computer device may apply a radial basis function (RBF) kernel-based change point detection to the time series to determine that the daily distributions include a weekend time period that has a different daily distribution than a time period before or after the weekend time period. The computer device may adjust a baseline prediction of the metric for the weekend time period. The computer device may send an alert based on a deviation of a value of the metric from the adjusted baseline prediction.

Abstract: Exception period data is removed from time series data that may be used for anomaly detection or other purposes. A changed time segment detector is configured to detect pairs of change points in received time series data that define changed time segments. Each detected pair of change points includes start and end points of a corresponding changed time segment. A changed time segment clusterer is configured to cluster the changed time segments into an arranged set of changed time segment clusters. An exception period identifier is configured to identify a changed time segment cluster as an exception period based on heuristics. A time series data indicator is configured to remove time series data corresponding to the exception time period from the received time series data to generate cleaned time series data.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums are described for machine learning-based techniques for reducing the visual complexity of a dependency graph that is representative of an application or service. For example, the dependency graph is generated that comprises a plurality of nodes and edges. Each node represents a compute resource (e.g., a microservice) of the application or service. Each edge represents a dependency between nodes coupled thereto. A machine learning-based classification model analyzes each of the nodes to determine a likelihood that each of the nodes is a problematic compute resource. For instance, the classification model may output a score indicative of the likelihood that a particular compute resource is problematic. The nodes and/or edges having a score that exceed a predetermined threshold are provided focus via the dependency graph.

Abstract: A monitoring system is configured to distinguish between two types of alert rules—namely, invariant alert rules and variant alert rules—and to apply a different method of alert rule evaluation to each, wherein each alert rule evaluation method deals with the issue of latent data ingestion in a different way. By tailoring the alert rule evaluation method to the type of alert rule being evaluated, the system can apply an optimized approach for each type of alert rule in terms of achieving a trade-off between alert latency, alert accuracy, and cost of goods sold. In an embodiment, the system utilizes a machine learning model to classify a query associated with an alert rule as either increasing or non-increasing. Then, based on the query classification and a condition associated with the alert rule, the system determines if the alert rule is invariant or variant.

Abstract: A computer platform for hosting applications utilizes a computing device to manage seasonal performance metric alerts. The computer device may include a memory and at least one processor coupled to the memory. The computer device may collect a time series of an application performance metric for a period of less than two weeks. The computer device may determine a daily distributions each day within the period. The computer device may apply a radial basis function (RBF) kernel-based change point detection to the time series to determine that the daily distributions include a weekend time period that has a different daily distribution than a time period before or after the weekend time period. The computer device may adjust a baseline prediction of the metric for the weekend time period. The computer device may send an alert based on a deviation of a value of the metric from the adjusted baseline prediction.