Confidence-controlled sampling methods and systems to analyze high-frequency monitoring data and event messages of a distributed computing system

A system to analyze behavior of a distributed computing system, the system comprising:

• one or more processors;
• one or more data-storage devices;
• and
• machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system to perform operations comprising:
• reading a sequence of monitoring data from a database stored in a data-storage device of a distributed computing system, the monitoring data generated by a first source in the distributed computing system;
• evaluating the monitoring data to determine a monitoring interval of the monitoring data and if the monitoring data is normal or sparse based on confidence-controlled sampling of the monitoring data, wherein confidence-controlled sampling of the monitoring data includes randomly selecting monitoring data points of the monitoring data based on a selected confidence level;
• when the monitoring data is normal,
• searching for a periodic pattern in behavior of the first source based on repeated confidence-controlled sampling of the monitoring data in two different time intervals separated by a period of time;
• searching for a change in behavior of the first source based on a similarity of the monitoring data computed from confidence-controlled samples of the monitoring data in two different time intervals;
• displaying an alert in a graphical user interface of an administrative console when a periodic pattern in the behavior of the first source is discovered;
• and
• displaying an alert in the graphical user interface of the administrative console when a change in behavior of the first source is detected.

A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform the operations comprising:

• reading a sequence of monitoring data from a database stored in a data-storage device of a distributed computing system, the monitoring data generated by a first source in the distributed computing system;
• evaluating the monitoring data to determine a monitoring interval of the monitoring data and if the monitoring data is normal or sparse based on confidence-controlled sampling of the monitoring data, wherein confidence-controlled sampling of the monitoring data includes randomly selecting monitoring data points of the monitoring data based on a selected confidence level;
• when the monitoring data is normal,
• searching for a periodic pattern in behavior of the first source based on repeated confidence-controlled sampling of the monitoring data in two different time intervals separated by a period of time;
• searching for a change in behavior of the first source based on a similarity of the monitoring data computed from confidence-controlled samples of the monitoring data in two different time intervals;
• displaying an alert in a graphical user interface of an administrative console when a periodic pattern in the behavior of the first source is discovered;
• and
• displaying an alert in the graphical user interface of the administrative console when a change in behavior of the first source is detected.