LISA 2000 Abstract
Aberrant Behavior Detection in Time Series for Network Service Monitoring
Jake D. Brutlag, Microsoft WebTV
The open-source software RRDtool and Cricket provide a solution to
the problem of collecting, storing, and visualizing service network
time series data for the real-time monitoring task. However,
simultaneously monitoring all service network time series of interest
is an impossible task even for the accomplished network technician.
The solution is to integrate a mathematical model for automatic
aberrant behavior detection in time series into the monitoring
software. While there are many such models one might choose, the
primary goal should be a model compatible with real-time monitoring.
At WebTV, the solution was to integrate a model based on exponential
smoothing and Holt-Winters forecasting into the Cricket/RRDtool
architecture. While perhaps not optimal, this solution is flexible,
efficient, and effective as a tool for automatic aberrant behavior