Server configuration anomaly detection

A method for applying one or more heuristics to collected server configurations to detect anomalous server configurations, the method comprising:

• requesting, by a collection system, server configuration data, including one or more server configuration values, from a plurality of configuration agents running on a plurality of hosted servers to detect anomalous server configurations,
• wherein the plurality of hosted servers is grouped into a plurality of groups, each group of the plurality of groups identified by one or more server identifiers and comprising hosted servers using a same or a related server configuration;
• receiving, at the collection system, from the plurality of configuration agents the one or more server configuration values of each hosted server in the plurality of hosted servers;
• storing the one or more server configuration values in one or more databases, organized based on the one or more server identifiers;
• accessing, by an analysis system, the one or more server configuration values from the one or more databases;
• applying one or more heuristics to the one or more server configuration values of the hosted servers in each group of the plurality of groups based on the one or more server identifiers;
• and
• in response to detecting the presence of one or more anomalous server configurations in the plurality of groups, providing a notification of one or more server configuration issues.

A system for applying one or more heuristics to collected server configurations to detect anomalous server configurations, the system comprising:

• at least one processor;
• and at least one non-transitory memory storing computer executable instructions that when executed by the at least one processor cause the system to carry out actions comprising:
• requesting, by a collection system, server configuration data, including one or more server configuration values, from a plurality of configuration agents running on a plurality of hosted servers to detect anomalous server configurations,
• wherein the plurality of hosted servers is grouped into a plurality of groups, each group of the plurality of groups identified by one or more server identifiers and comprising hosted servers using a same or a related server configuration;
• receiving, at the collection system, from the plurality of configuration agents the one or more configuration values of each hosted server in the plurality of hosted servers;
• storing the one or more server configuration values in one or more databases, organized based on the one or more server identifiers;
• accessing, by an analysis system, the one or more server configuration values from the one or more databases;
• applying one or more heuristics to the one or more server configuration values of the hosted servers in each group of the plurality of groups based on the one or more server identifiers;
• and
• in response to detecting the presence of one or more anomalous server configurations in the plurality of groups, providing a notification of one or more server configuration issues.