Adaptive metric collection, storage, and alert thresholds

Patent metadata

Field	Value
Publication number	US-11212208-B2
Application number	US-201916701065-A
Country	US
Kind code	B2
Filing date	Dec 2, 2019
Priority date	Nov 13, 2013
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

Techniques for adaptive metric collection, metric storage, and alert thresholds are described. In an approach, a metric collector computer processes metrics as a collection of key/value pairs. The key/value pairs represent the dimensionality of the metrics and allows for semantic queries on the metrics based on keys. In an approach, a storage controller computer maintains a storage system with multiple storage tiers ranked by speed of access. The storage computer stores policy data that specifies the rules by which metric records are stored across the multiple storage tiers. Periodically, the storage computer moves database records to higher or lower tiers based on the policy data. In an approach, a metric collector in response to receiving a new metric, generates a predicted metric value based on previously recorded metric values and measures the deviation from the new metric value to determine whether an alert is appropriate.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
storing previously collected metric values based on previous requests sent to a service server computer from one or more client computers during one or more previous periods of time;
at a current period of time, receiving a new metric value based on a request sent to the service server computer from a particular client computer;
performing regression on the previously collected metric values to determine a predicted metric value for the current period of time;
determining whether a deviation between the predicted metric value and the new metric value is greater than a first threshold;
determining whether the new metric value satisfies a second threshold, the second threshold comprising a predefined metric value; and
in response to the deviation being greater than the first threshold and to the new metric value satisfying the second threshold when the deviation is less than or equal to the first threshold, generating an alert.

2. The method of claim 1 , wherein the previously collected metric values are based on at least one of latency, dropped connections, request completion time, number of requests, success rate, or geographical distribution of the previous requests.

3. The method of claim 1 , wherein the regression on the previously collected metric values is based on double exponential smoothing.

4. The method of claim 1 , wherein the first threshold is based on a percent difference between the predicted metric value and the new metric value.

5. The method of claim 1 , wherein generating the alert comprises transmitting an electronic communication to a particular account or computing device.

6. The method of claim 1 , further comprising retrieving one or more rules specifying at least one of the regression, the first threshold, or the second threshold.

7. The method of claim 1 , wherein the first threshold is based on a level of noise in the previously collected metric values.

8. One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps of:
storing previously collected metric values based on previous requests sent to a service server computer from one or more client computers during one or more previous periods of time;
at a current period of time, receiving a new metric value based on a request sent to the service server computer from a particular client computer;
performing regression on the previously collected metric values to determine a predicted metric value for the current period of time;
determining whether a deviation between the predicted metric value and the new metric value is greater than a first threshold;
determining whether the new metric value satisfies a second threshold, the second threshold comprising a predefined metric value; and
generating an alert in response to the deviation being greater than the specified threshold and to the new metric value satisfying the second threshold when the deviation is less than or equal to the first threshold.

9. The one or more non-transitory computer-readable media of claim 8 , wherein the previously collected metric values are based on at least one of latency, dropped connections, request completion time, number of requests, success rate, or geographical distribution of the previous requests.

10. The one or more non-transitory computer-readable media of claim 8 , wherein the regression on the previously collected metric values is based on double exponential smoothing.

11. The one or more non-transitory computer-readable media of claim 8 , wherein the first threshold is based on a percent difference between the predicted metric value and the new metric value.

12. The one or more non-transitory computer-readable media of claim 8 , wherein generating the alert comprises sending an electronic communication to a particular account or computing device.

13. The one or more non-transitory computer-readable media of claim 8 , wherein the steps further comprise retrieving one or more rules specifying at least one of the regression, the first threshold, or the second threshold.

14. The one or more non-transitory computer-readable media of claim 8 , wherein the first threshold is based on a level of noise in the previously collected metric values.

15. A system, comprising:
a service server computer;
one or more client computers; and
a metric collector computer that:
stores previously collected metric values based on previous requests sent to the service server computer from the one or more client computers during one or more previous periods of time,
at a current period of time, receives a new metric value based on a request sent to the service server computer from a particular client computer,
performs regression on the previously collected metric values to determine a predicted metric value for the current period of time,
determines whether a deviation between the predicted metric value and the new metric value is greater than a first threshold,
determines whether the new metric value satisfies a second threshold, the second threshold comprising a predefined metric value, and
in response to the deviation being greater than the first threshold and to the new metric value satisfying the second threshold when the deviation is less than or equal to the first threshold, generates an alert.

16. The system of claim 15 , wherein the previously collected metric values are based on at least one of latency, dropped connections, request completion time, number of requests, success rate, or geographical distribution of the previous requests.

17. The system of claim 15 , wherein the metric collector computer further performs regression on the previously collected metric values based on double exponential smoothing.

18. The system of claim 15 , wherein the first threshold is based on a percent difference between the predicted metric value and the new metric value.

19. The system of claim 15 , wherein the metric collector computer generates the alert, at least in part, by transmitting an electronic communication to a particular account or computing device.

20. The system of claim 15 , wherein the metric collector computer further retrieves one or more rules specifying at least one of the regression, the first threshold, or the second threshold.

Assignees

• Netflix Inc

Inventors

• Rapoport Roy
• Pitman Brent
• Harrington Brian
• Muino Daniel

Classifications

• H04L41/147

  for predicting network behaviour · CPC title

• G06F11/008 Primary

  Reliability or availability analysis · CPC title

• H04L43/16 Primary

  Threshold monitoring · CPC title

• G06F11/328

  Computer systems status display (G06F11/327 takes precedence) · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title