Abstract: The technology disclosed relates to sub-clustering within service clusters in real-time. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections, wherein the node data includes software versions of the processes and process data with configuration files and clustering the multiple hosts with the service clusters into the sub-clusters based at least in part on the software versions.

Abstract: The technology disclosed relates to maintaining up to date software version data in a network. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections. It further relates to collecting current software version information for the processes, updating the network topology with the current software version for particular process running on a particular host when it differs from a stored software version in the network topology, reassigning the particular host to a sub-cluster within the service cluster according to the current software version, and monitoring the updated sub-cluster within the service cluster.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to learning how to efficiently display anomalies in performance data to an operator. In particular, it relates to assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and training a classifier that implements at least one circumstance-specific detector used to monitor a time series of performance data or to detect patterns in the time series. The training includes producing a time series of anomaly event candidates including corresponding event information used as input to the detectors, generating feature vectors for the anomaly event candidates, selecting a subset of the candidates as anomalous instance data, and using the feature vectors for the anomalous instance data and implicit and/or explicit feedback from users exposed to a visualization of the monitored time series annotated with visual tags for at least some of the anomalous instances data to train the classifier.