Know of an infrastructure monitoring tool that baselines and then measures/alerts variance?

Question

I'm searching for an infrastructure resource monitoring tool and after a day of Googling with no success, I'm hoping someone can help me locate it. I read about this about 6 months ago (I 'think' I found it through hackernews) and now I can't find the link to it.

In essence, this monitoring tool simply baselines everything, learning the patterns of your infrastructure usage, and then alerts you to variance in those patterns. As time passes, what was once a variable is relearned as a pattern, as the system continues to learn.

The company Riverbed has something similar in their Cascade product, but they only look at network traffic. Someone has this for server resource monitoring but I'm not finding them.

Anyone else remember reading about this new product recently?

Answer 1

After years of implementing a monitoring system using Nagios, I question the validity of such a tool except for a narrow set of services.

Most of the systems we use have wildly changing use characteristics over a typical day/week. Some systems are quite busy on Monday others Wednesday, etc. Some busy during the day while others overnight, etc.

I can image such a system getting it right for 25% of the systems or maybe getting certain parameters (like disk or memory free) right much of the time, other parameters like CPU or network util seem, to my small mind, real challenges.

Answer 2

There exists an algorithm called the Holt-Winters Time Series Forecasting Algorithm; it can be used to analyze time series data and detect anomalies, even if the time series data has a periodic fluctuation (daily peaks, for instance). rrdtool implements this as the "HWPREDICT" RRA, which collects additional data while monitoring to implement this algorithm and determine thresholds.

It's possible to use Holt-Winters analysis to dynamically determine thresholds based on actual data trends (as opposed to a priori configuration). $work has a completely custom system where we can add HWPREDICT data to specific RRAs and then generate alerts when the thresholds are exceeded. It works well, but as I said, is completely custom. I would love to know if there's an existing product that can do this for us.