Detecting systemwide service issues by using anomaly localization

A computer-implemented method for localizing anomalies across multiple services, the method comprising:

• receiving time-series monitoring data for multiple services, the time-series monitoring data including multiple dimensions and an error metric;
• for the time-series monitoring data from each service, evaluating scopes within the time-series monitoring data comprising:
• for a current scope, calculating an objective function score for a time series of the error metric limited by a current scope;
• identifying a random scope that is a not a neighbor scope of the current scope;
• calculating an objective function score for the random scope;
• based on the objective function scores of the random sampling of the neighbor scopes and the objective function score of the random scope, selecting one of the neighbor scopes or the random scope to be a next current scope;
• based on evaluating the scopes, generating a ranked list of scopes for each service based on objective function scores for the scopes;
• correlating the ranked lists of scopes across the multiple services to identify a cross-service anomaly;
• and
• generating an alert for the multiple services based on the cross-service anomaly, the alert indicating at least one scope as a potential root cause for the cross-service anomaly.

A computer-implemented method for localizing anomalies across multiple services, the method comprising:

• receiving time-series monitoring data for multiple services, the time-series monitoring data including multiple dimensions and an error metric;
• for the monitoring data from each service, evaluating scopes within the monitoring data based on an objective function for a time-series of the error metric to identify at least one anomalous scope, wherein evaluating the scopes comprises:
• for a current scope, calculating an objective function score for a time series of the error metric limited by the current scope;
• determining a random sampling of neighbor scopes of the current scope, wherein the neighbor scopes include at least a peer scope, a subset scope, or a superset scope;
• calculating objective function scores for random sampling of neighbor scopes;
• identifying a random scope that is a not a neighbor scope of the current scope;
• calculating an objective function score for the random scope;
• and
• based on the objective function scores of the random sampling of the neighbor scopes and the objective function score of the random scope, selecting one of the neighbor scopes or the random scope to be a next current scope;
• and
• generating an alert for the services based on a cross-service anomaly, the alert indicating at least one scope as a potential root cause for the cross-service anomaly.