Abstract: Techniques for predictive system remediation are disclosed. Based on attributes associated with applications of one or more system-selected remedial actions to one or more problematic system behaviors in a system (e.g., a database system), the system determines a predicted effectiveness of one or more future applications of a remedial action to a particular problematic system behavior, as of one or more future times. The system determines that the predicted effectiveness of the one or more future applications of the remedial action is positive but does not satisfy a performance criterion. Responsive to determining that the predicted effectiveness is positive but does not satisfy the performance criterion, the system generates a notification corresponding to the predicted effectiveness not satisfying the performance criterion.

Abstract: Systems and methods for trending patterns within a set of time-series data are described. In one or more embodiments, a set of one or more groups of data points that are associated with a particular seasonal pattern are generated within volatile and/or non-volatile storage. A set of pairwise slopes is determined for data point pairs within the set of one or more groups of data points. Based, at least in part on the plurality of pairwise slopes, a representative trend rate for the particular seasonal pattern is determined. A set of forecasted values is then generated within volatile or non-volatile storage based, at least in part, on the representative trend rate for the particular seasonal pattern.

Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system performs a responsive action, such as generating an alert.

Abstract: Techniques for training and evaluating seasonal forecasting models are disclosed. In some embodiments, a network service generates, in memory, a set of data structures that separate sample values by season type and season space. The set of data structures may include a first set of clusters corresponding to different season types in the first season space and a second set of clusters corresponding to different season types in the second season space. The network service merges two or more clusters the first set and/or second set of clusters. Clusters from the first set are not merged with clusters from the second set. After merging the clusters, the network service determines a trend pattern for each of the remaining clusters in the first and second set of clusters. The network service then generates a forecast for a metric of a computing resource based on the trend patterns for each remaining cluster.

Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.

Abstract: Systems and methods for trending patterns within a set of time-series data are described. In one or more embodiments, a set of one or more groups of data points that are associated with a particular seasonal pattern are generated within volatile and/or non-volatile storage. A set of pairwise slopes is determined for data point pairs within the set of one or more groups of data points. Based, at least in part on the plurality of pairwise slopes, a representative trend rate for the particular seasonal pattern is determined. A set of forecasted values is then generated within volatile or non-volatile storage based, at least in part, on the representative trend rate for the particular seasonal pattern.

Abstract: Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system performs a responsive action, such as generating an alert.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Techniques are described for automatically detecting and accommodating state changes in a computer-generated forecast. In one or more embodiments, a representation of a time-series signal is generated within volatile and/or non-volatile storage of a computing device. The representation may be generated in such a way as to approximate the behavior of the time-series signal across one or more seasonal periods. Once generated, a set of one or more state changes within the representation of the time-series signal is identified. Based at least in part on at least one state change in the set of one or more state changes, a subset of values from the sequence of values is selected to train a model. An analytical output is then generated, within volatile and/or non-volatile storage of the computing device, using the trained model.

Abstract: The present disclosure describes a flexible technique to learn patterns in time series data that recur over time. The patterns may be used for simulation, predicting future behavior, or detecting anomalies in a system in which the data is collected. The technique incrementally detects daily, weekly, monthly, and yearly patterns. Each pattern is built over time instead of requiring all the data to be available at the beginning of the analysis. Instead of modeling each pattern explicitly, each pattern is described in the context of a day and formed based on time series data collected over an entire day. An example use of the technique is detecting load patterns in a computer system. A metric of system load such as CPU utilization may be collected periodically over a day. The techniques presented herein capture multiple daily models, each representing a different load pattern.

Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.

Abstract: Techniques for efficiently generating aggregate distribution approximations are disclosed. In some embodiments, a system receives a plurality of piecewise approximations that represent different distributions of a set of values on at least one computing resource. Based on the plurality of piecewise approximations, a set of clusters are generated, within volatile or non-volatile memory, that approximate an aggregate distribution of the set of metric values on the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to an aggregate piecewise approximation of a function for the set of metric values on the at least one computing resource.

Abstract: Techniques are described for automatically detecting and accommodating state changes in a computer-generated forecast. In one or more embodiments, a representation of a time-series signal is generated within volatile and/or non-volatile storage of a computing device. The representation may be generated in such a way as to approximate the behavior of the time-series signal across one or more seasonal periods. Once generated, a set of one or more state changes within the representation of the time-series signal is identified. Based at least in part on at least one state change in the set of one or more state changes, a subset of values from the sequence of values is selected to train a model. An analytical output is then generated, within volatile and/or non-volatile storage of the computing device, using the trained model.

Abstract: Techniques for generating distribution approximations with low memory footprints are disclosed. In some embodiments, a system receives a first set of values that measure one or more metrics of at least one computing resource. A set of clusters are generated, within volatile or non-volatile memory, that approximate a distribution of the first set of values measuring the one or more metrics of the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to a piecewise approximation of a function for the first set of values.

Abstract: Techniques are described for optimizing scalability of analytics that use time-series models. In one or more embodiments, a stored time-series model includes a plurality of data points representing seasonal behavior in a training set of time-series data for at least one season. A target time for evaluating the time-series model is then determined, and the target time or one or more times relative to the target time are mapped to a subset of the plurality of data points. Based on the mapping, a trimmed version of the time-series model is generated by loading the subset of the plurality of data points into a cache, the subset of data points representing seasonal behavior in the training set of time-series data for a portion of the at least one season. A target set of time-series data may be evaluated suing the trimmed version of the time-series in the cache.

Abstract: Techniques are described for applying what-f analytics to simulate performance of computing resources in cloud and other computing environments. In one or more embodiments, a plurality of time-series datasets are received including time-series datasets representing a plurality of demands on a resource and datasets representing performance metrics for a resource. Based on the datasets at least one demand propagation model and at least one resource prediction model are trained. Responsive to receiving an adjustment to a first set of one or more values associated with a first demand: (a) a second adjustment is generated for a second set of one or more values associated with a second demand; and (b) a third adjustment is generated for a third set of one or more values that is associated with the resource performance metric.

Abstract: Techniques for predictive system remediation are disclosed. Based on attributes associated with applications of one or more system-selected remedial actions to one or more problematic system behaviors in a system (e.g., a database system), the system determines a predicted effectiveness of one or more future applications of a remedial action to a particular problematic system behavior, as of one or more future times. The system determines that the predicted effectiveness of the one or more future applications of the remedial action is positive but does not satisfy a performance criterion. Responsive to determining that the predicted effectiveness is positive but does not satisfy the performance criterion, the system generates a notification corresponding to the predicted effectiveness not satisfying the performance criterion.

Abstract: Techniques are described for generating predictive alerts. In one or more embodiments, a seasonal model is generated, the seasonal model representing one or more seasonal patterns within a first set of time-series data, the first set of time-series data comprising data points from a first range of time. A trend-based model is also generated to represent trending patterns within a second set of time-series data comprising data points from a second range of time that is different than the first range of time. A set of forecasted values is generated based on the seasonal model and the trend-based model. Responsive to determining that a set of alerting thresholds has been satisfied based on the set of forecasted values, an alert is generated.