Detecting anomalies in a distributed application

A non-transitory computer readable medium comprising instructions that are executable in one or more computing devices to cause the computing devices to carry out a method of detecting anomalies in a distributed application that runs on a plurality of nodes that include a first node and a second node, to execute at least first and second workloads, wherein the first workload is executed on the first node by a first group of containers of a first pod and on the second node by a second group of containers of a second pod that is a replica of the first pod, and the second workload is executed by at least third and fourth groups of containers, said method comprising:

• collecting first network traffic data of the first group of containers and second network traffic data of the second group of containers;
• during an anomaly detection period, either computing a first message rate of all egress traffic from the first pod from the collected first network traffic data and a second message rate of all egress traffic from the second pod from the collected second network traffic data, or computing a third message rate of all ingress traffic to the first pod from the collected first network traffic data and a fourth message rate of all ingress traffic to the second pod from the collected second network traffic data;
• and
• determining whether or not an anomaly is present in the distributed application based on at least a comparison of the collected first network traffic data and the collected second network traffic data, wherein the anomaly is determined to be present in the first pod based on the first message rate differing from the second message rate by more than a first threshold or the third message rate differing from the fourth message rate by more than a second threshold.

A computing system for detecting anomalies in a distributed application that runs on a plurality of nodes that include a first node and a second node, to execute at least first and second workloads, wherein the first workload is executed on the first node by a first group of containers of a first pod and on the second node by a second group of containers of a second pod that is a replica of the first pod, and the second workload is executed by at least third and fourth groups of containers, said computing system comprising:

• a storage device in which first network traffic data of the first group of containers and second network traffic data of the second group of containers are stored;
• and
• an anomaly detection server configured to:
• collect the first network traffic data of the first group of containers and the second network traffic data of the second group of containers;
• during an anomaly detection period, either compute a first message rate of all egress traffic from the first pod from the collected first network traffic data and a second message rate of all egress traffic from the second pod from the collected second network traffic data, or compute a third message rate of all ingress traffic to the first pod from the collected first network traffic data and a fourth message rate of all ingress traffic to the second pod from the collected second network traffic data;
• and
• determine whether or not an anomaly is present in the distributed application based on at least a comparison of the collected first network traffic data and the collected second network traffic data, wherein the anomaly is determined to be present in the first pod based on the first message rate differing from the second message rate by more than a first threshold or the third message rate differing from the fourth message rate by more than a second threshold.