Abstract: In exemplary embodiments, a computer system detects performance anomalies for user computer services. Physical databases convert physical database KPIs into logical database KPI vectors for individual user services and individual time intervals. Physical application servers convert physical application server KPIs into logical application server KPI vectors for the individual user services and time intervals. Physical web servers convert physical web server KPIs into logical web server KPI vectors for the individual user services and time intervals. A KPI server combines the logical database KPI vectors, the logical application server KPI vectors, and the logical web server KPI vectors for individual time intervals into user service KPI vectors for the individual user services during the time intervals. The KPI server detects outlier user service KPI vectors as compared to normal user service KPI vectors and indicates corresponding computer performance anomalies for the user services.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: In an exemplary embodiment, computer circuitry determines term characterization values for terms in computer performance logs and generates vectors that indicate the term characterization values. The computer circuitry determines vector similarity scores for these vectors. The computer circuitry aggregates the computer performance logs into aggregated logs based on the vector similarity scores. The computer circuitry selects rare logs from these aggregated logs and obtains computer performance anomaly labels for the rare logs. The computer circuitry matches new computer performance logs with the rare logs to detect the labeled computer performance anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: In an exemplary embodiment, a computer system hosts a logical Key Performance Indicator (KPI) network to detect computer performance anomalies. Databases execute database KPI nodes, database edges, and database instance nodes of the logical KPI network to propagate database KPI data to a KPI server system. Application servers execute application server KPI nodes, application server edges, and application server instance nodes of the logical KPI network to propagate application server KPI data to the KPI server system. Web servers execute web server KPI nodes, web server edges, and web server instance nodes of the logical KPI network to propagate web server KPI data to the KPI server system. This KPI data indicates logical data path information for the propagated KPI data (instead of KPI values). The KPI server system processes the logical data path information to indicate the computer performance anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

Abstract: In an exemplary embodiment, computer circuitry determines term characterization values for terms in computer performance logs and generates vectors that indicate the term characterization values. The computer circuitry determines vector similarity scores for these vectors. The computer circuitry aggregates the computer performance logs into aggregated logs based on the vector similarity scores. The computer circuitry selects rare logs from these aggregated logs and obtains computer performance anomaly labels for the rare logs. The computer circuitry matches new computer performance logs with the rare logs to detect the labeled computer performance anomalies.

Abstract: In an exemplary embodiment, computer circuitry determines term characterization values for terms in computer performance logs and generates vectors that indicate the term characterization values. The computer circuitry determines vector similarity scores for these vectors. The computer circuitry aggregates the computer performance logs into aggregated logs based on the vector similarity scores. The computer circuitry selects rare logs from these aggregated logs and obtains computer performance anomaly labels for the rare logs. The computer circuitry matches new computer performance logs with the rare logs to detect the labeled computer performance anomalies.

Abstract: In exemplary embodiments, a computer system detects performance anomalies for user computer services. Physical databases convert physical database KPIs into logical database KPI vectors for individual user services and individual time intervals. Physical application servers convert physical application server KPIs into logical application server KPI vectors for the individual user services and time intervals. Physical web servers convert physical web server KPIs into logical web server KPI vectors for the individual user services and time intervals. A KPI server combines the logical database KPI vectors, the logical application server KPI vectors, and the logical web server KPI vectors for individual time intervals into user service KPI vectors for the individual user services during the time intervals. The KPI server detects outlier user service KPI vectors as compared to normal user service KPI vectors and indicates corresponding computer performance anomalies for the user services.

Abstract: In an exemplary embodiment, computer circuitry determines term characterization values for terms in computer performance logs and generates vectors that indicate the term characterization values. The computer circuitry determines vector similarity scores for these vectors. The computer circuitry aggregates the computer performance logs into aggregated logs based on the vector similarity scores. The computer circuitry selects rare logs from these aggregated logs and obtains computer performance anomaly labels for the rare logs. The computer circuitry matches new computer performance logs with the rare logs to detect the labeled computer performance anomalies.

Abstract: In an exemplary embodiment, a computer system hosts a logical Key Performance Indicator (KPI) network to detect computer performance anomalies. Databases execute database KPI nodes, database edges, and database instance nodes of the logical KPI network to propagate database KPI data to a KPI server system. Application servers execute application server KPI nodes, application server edges, and application server instance nodes of the logical KPI network to propagate application server KPI data to the KPI server system. Web servers execute web server KPI nodes, web server edges, and web server instance nodes of the logical KPI network to propagate web server KPI data to the KPI server system. This KPI data indicates logical data path information for the propagated KPI data (instead of KPI values). The KPI server system processes the logical data path information to indicate the computer performance anomalies.