Online performance anomaly detection for large-scale software systems
Tillmann Carlos Bielefeld · 2012
Provisioning satisfying Quality of Service (QoS) is a challenge when operating large-scale software systems. Performance and availability are important metrics for QoS, especially for Internet applications. Since these systems are accessed concurrently, bad performance can manifest itself in slow response time for all users simultaneously. Software solutions for monitoring these metrics exist and abnormal behavior in the performance is often analyzed later for future improvement. However, in interactive applications, users notice anomalies immediately and reactions require automatic online detection. This is hard to achieve since large-scale applications are operated in grown, unique environments. These domains often include a network of subsystems with system-specific measures and characteristics. Thus, anomaly detection is hard to establish as it requires a custom setup for each system. This work approaches these challenges by implementing means for online anomaly detection based on time series analysis, called OPAD. In a monitoring server different algorithms can be configured and evaluated in order to address system-specific characteristics. The software is designed as a plugin for the performance monitoring and dynamic analysis framework Kieker. With the use of selected algorithms, it can detect and signal anomalies online and store them for post-mortem analyses. The social network system XING served as a case study and the evaluation of OPAD in this production environment shows promising results in terms of robustness and accuracy.