Systems and methods for automatically detecting, summarizing, and responding to anomalies

One or more non-transitory computer-readable media storing instructions, which when executed by one or more hardware processors, cause:

• identifying a plurality of time series that track different metrics over time for a set of one or more computing resources;
• detecting a first set of anomalies in a first time series, of the plurality of time series, that tracks a first metric over time;
• assigning a different respective range of time to each anomaly in the first set of anomalies;
• determining for said each anomaly whether the respective range of time assigned to the anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series, of the plurality of time series, that track one or more other metrics over time;
• generating a cluster of a first group of metrics that groups the first metric and at least a second metric from the one or more other metrics based on how many anomalies in the first set of anomalies have respective ranges of time that overlap with timestamps or ranges of time associated with anomalies from the one or more other time series;
• generating a second group of metrics, different than the first group of metrics, that matches a set of one or more application dimensions and also includes the first metric;
• generating, based at least in part on a severity associated with anomalies in the first set of anomalies, a first score for the first group of metrics and a second score for the second group of metrics;
• performing, based on at least the first score and the second score, at least one automated action for diagnosing or correcting a cause of anomalous behavior exhibited by at least one metric on at least one computing resource in the set of one or more computing resources.

A system comprising:

• one or more hardware processors;
• one or more non-transitory computer-readable media storing instructions, which when executed by the one or more hardware processors, cause:
• identifying a plurality of time series that track different metrics over time for a set of one or more computing resources;
• detecting a first set of anomalies in a first time series, of the plurality of time series, that tracks a first metric over time;
• assigning a different respective range of time to each anomaly in the first set of anomalies;
• determining for said each anomaly whether the respective range of time assigned to the anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series, of the plurality of time series, that track one or more other metrics over time;
• generating a cluster of a first group of metrics that groups the first metric and at least a second metric from the one or more other metrics based on how many anomalies in the first set of anomalies have respective ranges of time that overlap with timestamps or ranges of time associated with anomalies from the one or more other time series;
• generating a second group of metrics, different than the first group of metrics, that matches a set of one or more application dimensions and also includes the first metric;
• generating, based at least in part on a severity associated with anomalies in the first set of anomalies, a first score for the first group of metrics and a second score for the second group of metrics;
• performing, based on at least the first score and the second score, at least one automated action for diagnosing or correcting a cause of anomalous behavior exhibited by at least one metric on at least one computing resource in the set of one or more computing resources.