Performance Anomaly Detection and Bottleneck Identification

Abstract

In order to meet stringent performance requirements, system administrators must e↵ectively detect undesirable performance behaviours, identify potential root causes and take adequate corrective measures. The problem of uncovering and understanding performance anomalies and their causes (bottlenecks) in di↵erent system and application domains is well studied. In order to assess progress, research trends and identify open challenges, we have reviewed major contributions in the area and present our findings in this survey. Our approach provides an overview of anomaly detection and bottleneck identification research as it relates to the performance of computing systems. By identifying fundamental elements of the problem, we are able to categorize existing solutions based on multiple factors such as the detection goals, nature of applications and systems, system observability, and detection methods.

Reducing the Monitoring Register for the Detection of Anomalies in Software Defined Networks

“…When the analyzed register has low frequencies, a dilated wavelet will allow to obtained coefficients of high value, indicating the presence of low frequencies; when the register has high frequencies, a contracted wavelet would allow to obtain coefficients of high value, indicating the presence of high frequencies. The more similar the wavelet to the form of the network activity register, the wavelet coefficients will be higher in a given time [1] …”

“…This verification is a constant activity that requires the analysis of large volumes of information and short response times, and it is an activity that must compensate the overhead in the measurement and its accuracy [1].…”

A Black-Box Approach for Detecting Systems Anomalies in Virtualized Environments

“…• RUBBoS 5 : a Slashdot-like bulleting board web application running on two distributed VMs (red stack), an Apache 2.0 web server (VM5) and MySQL 5.0 server (VM6) • Load applications: We dynamically deploy one of three application utilities in VMs of the blue stack (VM1 and VM2) to generate background load on the testbed to mimic real environments where diverse applications are co-located: a) Sudoku, an application that solves a series of Sudoku puzzles in parallel 6 , and b) Stress-ng, a load generator to stress system resources 7 .…”

“…A few extensive surveys [6], [7] have been dedicated to reviewing existing research contributions on performance anomaly detection in distributed and computing systems in general.…”

“…While research surveys such as [6], [7] demonstrate the popularity of anomaly detection especially in systems domains, most existing solutions are not fully tailored to meet the above requirements. The classical approach predefines thresholds based on assumed distribution [8], [9] that are sensitive to workload variations and become unwieldy scaling to hundreds of metrics.…”