Method for detecting program performance anomalies, computer program and computer system (Program performance anomaly detection)

Abstract

To provide a method, system and computer program product for performance anomaly detection.SOLUTION: Velocity data is periodically received from a workload manager for one or more address spaces. An expected velocity value is created for each of the one or more address spaces. A factor of the expected velocity value is compared to a current velocity value from the velocity data. Based on the current velocity value being lower than the factor, a remedial action is generated indicating an anomaly.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] FIELD OF THE INVENTION Embodiments of the present invention relate generally to computer systems, and more particularly to performance anomaly detection. [Background technology]

[0002] Program performance anomaly detection involves analyzing system behavior to determine whether a range of metrics indicates normal behavior or abnormal behavior. To reduce the likelihood of false positives, gathering corroborating evidence of anomalous behavior can help further narrow down the symptoms of relevant problems. However, identifying such evidence often requires the system to operate in an anomalous manner in order to gather useful data. Summary of the Invention [Problem to be solved by the invention]

[0003] In very fast computing environments, it is advantageous to incorporate performance degradation detection into a process that automatically initiates further analysis of possible underlying anomalies. [Means for solving the problem]

[0004] Among other things, a method for performance anomaly detection is provided. Rate data is periodically received from a workload manager for one or more address spaces. A predicted rate value is created for each of the one or more address spaces. A factor of the predicted rate value is compared to a current rate value from the rate data. Based on the current rate value being lower than the factor, a corrective action is generated indicating an anomaly.

[0005] Embodiments are further directed to computer systems and computer program products having substantially the same features as the computer-implemented methods described above.

[0006] Additional features and advantages are realized through the techniques described herein. Other embodiments and aspects are described in detail herein. For a better understanding, reference is made to the specification and drawings. [Brief explanation of the drawings]

[0007] The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of this specification. The foregoing and other features and advantages will be apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0008] [Figure 1] FIG. 1 is a functional block diagram of an exemplary system according to an embodiment of the present invention.

[0009] [Figure 2] 1 illustrates a predictive failure analysis system according to an embodiment of the present invention.

[0010] [Figure 3] Illustrates the workflow of a predictive failure analysis system.

[0011] [Figure 4] FIG. 2 is an exemplary functional block diagram of a computing device for implementing aspects of the present invention, according to an embodiment of the invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] This disclosure relates generally to the field of program performance anomaly detection. Program and system anomaly detection analyzes normal program and system behavior to discover aberrant execution due to attacks, incorrect environment configurations, program bugs, and unusual usage patterns.

[0013] Anomaly detection involves identifying unexpected items or events in a dataset that differ from the norm. Anomaly detection assumes that anomalies occur rarely in the data and that the characteristics of the anomaly differ significantly from normal instances.

[0014] A common approach used by IT operations staff is to assume everything is working fine until a performance problem occurs. Current practice uses several silos of management tools to monitor system behavior and provide drill-down to determine underlying symptoms. The nature and complexity of determining the problem may vary depending on the user's background and experience. For example, an experienced administrator may know to run one tool over another or to run a specific sequence of commands that a less experienced administrator may not know. Operator commands may be used to look for unusual behavior. However, in very fast computing environments, it is advantageous to incorporate performance degradation detection into a process that automatically initiates further analysis of possible underlying anomalies.

[0015] Currently, the Workload Manager (WLM) component of an operating system allows system administrators to define performance goals within service classes, which are named groupings of work within a workload that have similar performance characteristics in terms of performance goals, resource requirements, and commercial importance to the enterprise.

[0016] This includes metrics that indicate average response time, percentile response time, velocity targets, and goals for discretionary workloads. Velocity is a measure of how quickly work should be performed when ready, without delays due to system resources. It is defined as a measure of processor activity used to process a workload over time, along with delays incurred in helping process the workload. Delays include operating system processes related to processor, storage, and I / O, including memory paging, page swapping, job creation and initialization delays, etc.

[0017] Predictive Failure Analysis (PFA) is an operating system component that collects data, models the collected data to create predicted values or rates, and compares the predicted values or rates to current metrics to determine if anomalous behavior is occurring. PFA functionality preemptively detects damage within the address space that could result in a system outage.

[0018] Current practice is that the output of WLM and the output of PFA are separate. PFA may collect historical data based on individual address spaces, groups of address spaces, or the entire system. However, PFA does not collect performance data or data from WLM for performance monitoring.

[0019] An embodiment of the present invention combines WLM and PFA processing by allowing PFA to collect WLM rate data at address-space granularity, model a predictive value based on historical data, and compare the predictive value factor to current rates. This modeled data is used to determine whether the address space is operating normally or exhibiting less than normal behavior and therefore degraded. An evaluation of the results is then used to determine whether to declare a performance anomaly occurring on the system. The determination of a performance anomaly is used to initiate a process that can directly alert an installation automation product, a system administrator, or both, to bring the performance anomaly to immediate attention. For example, the installation automation product may generate a report or problem ticket, or both, and may initiate the collection of relevant diagnostic data to further determine the problem symptoms.

[0020] Embodiments of the invention will now be described in more detail with reference to the drawings.

[0021] 1 is a functional block diagram of a computer system 100. The computer system includes a computer system / server (server) 12 according to an embodiment of the invention. The computer system 100 may include more than one server 12. The server 12 may include any computer capable of hosting and running WLM and PFA, receiving large volumes of log and similar data (e.g., terabytes or more) from hardware, operating systems, and applications, performing statistical analysis on the log and similar data, and modeling the collected data to determine whether anomalies are occurring in one or more workloads.

[0022] The functions and processes of server 12 may be described in terms of computer system executable instructions, such as program modules, routines, objects, data structures, and logic, that perform particular tasks or implement particular abstract data types. Server 12 may be part of a distributed cloud computing environment in which tasks are performed by one or more servers 12 connected through a communications network, such as network 13.

[0023] As shown in FIG. 1, server 12 may include one or more processors or processing units 16, a system memory 28, and a bus 18 coupling various system components, including processing units 16, from system memory 28.

[0024] Bus 18 represents one or more of several types of bus structures, including a memory bus, a memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures.

[0025] The server 12 typically includes a variety of computer system readable media, which may be any available media that can be accessed by the computer system / server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

[0026] Memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. For example, storage system 34 may include non-removable, non-volatile magnetic media, such as a "hard drive," and optical disk drives for reading from and writing to removable, non-volatile optical disks, such as CD-ROMs, DVD-ROMs, or other optical media. Each device in storage system 34 may be connected to bus 18 by one or more data media interfaces, such as I / O interface 22.

[0027] Each program 40 represents one of multiple programs stored in storage system 34 and loaded into memory 28 for execution. Program 40 may include an instance of an operating system, an application, a system utility, or the like. Each program 40 includes one or more modules 42. In the present invention, both WLM and PFA are examples of programs 40. There are several possible configurations of WLM and PFA. For example, WLM and PFA may all reside on the same server 12.

[0028] Server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, and display 24, one or more devices that allow a user to exchange information with server 12, and / or any device (e.g., a network card, modem, etc.) that allows server 12 to communicate with one or more other computing devices. Such communication may occur via an input / output (I / O) interface 22. Server 12 may communicate with one or more networks, such as network 13, via a network adapter 20. As shown, network adapter 20 communicates with other components of server 12 via bus 18. Although not shown, other hardware and / or software components may be used in conjunction with server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems.

[0029] FIG. 2 illustrates a predictive failure analysis system (PFA system) 200 that may be implemented on computer system 100 of FIG. 1 according to an embodiment of the present invention.

[0030] The predictive failure analysis address space (PFA address space) 215 of the PFA system 200 receives raw performance data 250 from WLM in real time, near real time, or in batches. The frequency of collection of the raw performance data 250 can be configured. For example, by default, collection occurs every minute, but may be configured differently. The received performance data 250 is stored in data collection 220 for further processing.

[0031] Additional configurable parameters include the minimum number of minutes (uptime) an address space must be active before PFA will collect historical data. This avoids collecting data for transient or short-lived address spaces. The default is 60 minutes. If an address space ends and is restarted, it is considered a new job and the minimum uptime must be met. Data from address spaces with the same name is not used in modeling the newly activated address space. Multiple address spaces with the same name are collected separately using name / address space identifier / start time clues. Address spaces that start within the first hour following a server IPL do not need to wait before being collected. However, the address space must be active for one collection interval before being collected.

[0032] The category configurable parameter can be used to define which address space categories are collected. Specifying a lower category automatically includes the higher categories. For example, if "Important" is specified, both "Very Important" and "Important" categories will be collected.

[0033] "Very critical" address space is that associated with very critical system work and infrastructure, e.g., system tasks. "Critical" address space includes "Very critical" address space plus very critical middleware servers that are defined as very critical. "Normal" address space includes "Very critical" and "Critical" address space plus normal work. Normal work includes non-server applications and services. Using the "Critical" default, server-type address space is included in the collection unless it meets uptime requirements and is specifically excluded from collection by configuration parameters. Discretionary work is not an allowed category.

[0034] The PFA address space 215 may provide one or more interfaces, such as a GUI, a command line, and a parameter file, to receive management commands to perform actions on the data collection 220. The actions may specify which workload, address space, and / or job data to include or exclude from WLM data collection. Various actions may further specify which of the data collections 220 to include in predictive failure analysis and modeling (PFA modeling) 225. Additional parameters controlling the operation of the PFA address space 215 include parameters to stop / start / modify the collection of specific classes of data, add / remove workloads and address spaces for collection, and exclude specific jobs from collection. Additional parameters may specify how often the data collection 220 is analyzed and modeled. The data collection 220 may be categorized by address space source, date, record type, or other criteria. The data collection 220 is input into the PFA modeling 225 and becomes historical data 230 for updating the model. PFA address space 215 stores the last hour, 24 hours, and 7 days' worth of raw data collection as historical data 230. These intervals may be configurable. Previous models may be stored in historical data 230. PFA modeling 225 may use machine learning with custom algorithms developed by the company running PFA system 200. PFA modeling 225 may utilize export application programming interface APIs from one or more statistical modeling software packages, such as IBM Watoson® Machine Learning, to create models.

[0035] FIG. 3 illustrates the workflow of a PFA system 200 according to an embodiment of the present invention.

[0036] At 310, the PFA address space 215 address space receives velocity data from WLM. The velocity is calculated as (usage samples x 100) / (usage samples + delay samples). Here, usage samples include all types of processor usage samples (e.g., CPU, memory, cache) and I / O usage samples. Delay samples include all types of processor delays, I / O delays, storage delays, and queuing delays. The WLM address space velocity is calculated based on these so-called "usage" and "delay" samples. The WLM address space velocity is a measure of how quickly work should move when ready without delaying for WLM-managed resources. The velocity is a percentage between "0" and "100." A low velocity value indicates that the address space has few of the resources it needs and competes with other address spaces for resources. A high velocity value indicates that the address space has all the resources it needs to execute. For example, "100" indicates that the address space sampled did not experience any delays due to processor or I / O resources managed by WLM.

[0037] At 320, PFA address space 215 notifies PFA modeling 225 to model the rate data. The modeling results in a predicted rate value for each monitored address space. Rate values for each address space are calculated every 12 hours by default. Predicted rate values are calculated for 1 hour of historical data, 24 hours of historical data, and 7 days of historical data. These periods may be configurable.

[0038] At 330, the current speed is compared to a factor, or percentage, of the predicted speed value.

[0039] If, at 340, the comparison indicates that the current rate is too low compared to the predicted rate value factor, at 350, the PFA address space 215 reports the anomaly and its impact based on the WLM severity level setting. An alert is generated, and the alert may be input to an automation system to generate a problem ticket and for IT personnel. The anomaly may also be reported to an operating system component that performs runtime diagnostics. The alert may include an application identifier, such as a name or job number, a server identifier, and an indication of the nature of the problem, including any system messages. The severity level indicates how important it is for a workload to meet its performance goals. For example, after a data modeling cycle to establish normal state ranges, if an address space is experiencing a performance problem, it can be detected and brought to attention before an administrator notices it, even if the address space's WLM service class is meeting its goals.

[0040] FIG. 4 illustrates an exemplary computing device 400 applicable for executing the algorithm of FIG. 3 . The computing device 400 may include a respective set of internal components 800 and external components 900 that may together provide an environment for a software application. Each of the set of internal components 800 includes one or more processors 820, one or more computer-readable RAMs 822, one or more computer-readable ROMs 824, one or more buses 826, one or more operating systems 828 that execute the algorithm of FIG. 3 , and one or more computer-readable tangible storage devices 830. The one or more operating systems 828 are stored in one or more respective computer-readable tangible storage devices 830 for execution by the one or more respective processors 820 via one or more respective RAMs 822 (which typically include cache memory). In the embodiment illustrated in FIG. 4 , each of the computer-readable tangible storage devices 830 is an internal hard drive magnetic disk storage device. Alternatively, each of the computer-readable tangible storage devices 830 is a semiconductor storage device, such as ROM 824, EPROM, flash memory, or any other computer-readable tangible storage device capable of storing computer programs and digital information.

[0041] Each set of internal components 800 also includes a R / W drive or interface 832 for reading from / writing to one or more computer-readable tangible storage devices 936, such as CD-ROM, DVD, SSD, USB memory stick, and magnetic disk.

[0042] Each set of internal components 800 may also include a network adapter (or switch port card) or interface 836, such as a TCP / IP adapter card, a wireless Wi-Fi interface card, a 3G or 4G wireless interface card, or other wired or wireless communication link. An operating system 828 associated with a computing device 400 may be downloaded to the computing device 400 from an external computer (e.g., a server) via a network (e.g., the Internet, a local area network, or other wide area network) and the respective network adapter or interface 836. The operating system 828 associated with the computing device 400 is loaded from the network adapter (or switch port adapter) or interface 836 onto the respective hard drive 830 and network adapter 836.

[0043] External components 900 may also include a touch screen 920, a keyboard 930, and a pointing device 934. Device drivers 840, R / W drive or interface 832, and network adapter or interface 836 comprise hardware and software (stored in storage 830 or ROM 824, or both).

[0044] Various embodiments of the invention may be implemented within a data processing system suitable for storing and / or executing program code, including at least one processor coupled directly or indirectly to memory elements through a system bus, including, for example, local memory utilized during the actual execution of the program code, mass storage devices, and cache memory that provides temporary storage of at least some program code to reduce the number of times the code must be retrieved from mass storage devices during execution.

[0045] Input / output or I / O devices (including but not limited to keyboards, displays, pointing devices, DASDs, tapes, CDs, DVDs, thumb drives, and other memory media) may be coupled to the system directly or through intervening I / O controllers. Network adapters may also be coupled to the system through intervening private or public networks to enable the data processing system to be coupled to other data processing systems or remote printers or storage devices. Modems, cable modems, and Ethernet cards are just a few of the types of network adapters available.

[0046] The present invention may be a system, method and / or computer program product at any possible level of technical detail of integration. The computer program product may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to implement aspects of the present invention.

[0047] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves having recorded instructions, and any suitable combination of the foregoing. Computer-readable storage medium, as used herein, is not to be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over a wire.

[0048] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0049] The computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages. The one or more programming languages include object-oriented programming languages such as Smalltalk®, C++, etc., and procedural programming languages such as the “C” programming language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, to perform aspects of the present invention, an electronic circuit, including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuit.

[0050] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0051] These computer-readable program instructions may be provided to a computer processor or other programmable data processing apparatus to produce a machine, whereby the instructions are executed by the computer processor or other programmable data processing apparatus to create means for implementing the functions / acts identified by the block or blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus and / or other device to function in a particular manner. The computer-readable storage medium having instructions stored therein thereby comprises an article of manufacture including instructions that implement aspects of the functions / acts identified in the block or blocks of the flowcharts and / or block diagrams.

[0052] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device and cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to create a computer-implemented process, whereby the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts identified in the blocks or blocks of the flowcharts and / or block diagrams.

[0053] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be completed as a single step, executed simultaneously, substantially simultaneously, partially, or completely in a time-overlapping manner, or the blocks may be executed in the reverse order, depending on the functionality required. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified function or operation or that implements a combination of special-purpose hardware and computer instructions.

[0054] While preferred embodiments have been shown and described in detail herein, it will be apparent to those skilled in the art that various modifications, additions, substitutions, etc. may be made therein without departing from the spirit of the disclosure, and therefore are deemed to be within the scope of the disclosure as defined by the following claims. According to this specification, the following items are also disclosed. [Item 1] 1. A method for program performance anomaly detection, comprising: periodically receiving rate data from a workload manager for one or more address spaces; generating a predicted speed value for each of the one or more address spaces; comparing a factor of the predicted speed value with a current speed value from the speed data; taking corrective action based on said current speed value being lower than said factor, indicating an anomaly; A method for providing the above. [Item 2] 2. The method of claim 1, wherein the rate data is received in near real time, real time, or batches. [Item 3] 3. The method of claim 1 or 2, wherein the current speed value is calculated by multiplying the used samples by 100 and dividing by the sum of the used samples and the delayed samples. [Item 4] The step of generating the predicted speed values includes inputting the received speed data and historical data into a statistical modeling software package and outputting the predicted speed values. 4. The method according to any one of items 1 to 3, further comprising: [Item 5] Item 4. The method of item 3, wherein the usage samples include all types of processor usage and the delay samples include all types of processor delays, I / O delays, storage delays and queuing delays. [Item 6] 6. The method of any one of items 1 to 5, wherein the corrective action includes generating an alert to an automated problem reporting system, the alert including an application identifier such as a name or job number, a server identifier, an indication of the nature of the problem, and any system messages. [Item 7] 7. The method of any one of items 1 to 6, wherein the factor of the predicted speed and the period for collecting the speed data are configurable. [Item 8] 1. A computer program for program performance anomaly detection, comprising: periodically receiving rate data from a workload manager for one or more address spaces; generating a predicted speed value for each of the one or more address spaces; comparing a factor of said predicted speed value with a current speed value from said speed data; and taking corrective action based on the current speed value being lower than the factor, indicating an anomaly. [Item 9] Item 9. The computer program of item 8, wherein the rate data is received in near real time, real time, or batches. [Item 10] 10. The computer program of claim 8 or 9, wherein the current speed value is calculated by multiplying the used samples by 100 and dividing by the sum of the used samples and the delayed samples. [Item 11] The step of generating the predicted speed value includes the steps of inputting the received speed and historical data into a statistical modeling software package; and outputting the predicted speed value. 11. The computer program according to any one of items 8 to 10, further comprising: [Item 12] Item 11. The computer program of item 10, wherein the usage samples include all types of processor usage and the delay samples include all types of processor delays, I / O delays, storage delays and queuing delays. [Item 13] 13. The computer program of any one of items 8 to 12, wherein the corrective action includes generating an alert to an automated problem reporting system, the alert including an application identifier such as a name or job number, a server identifier, an indication of the nature of the problem, and any system messages. [Item 14] 14. The computer program of any one of items 8 to 13, wherein the factor of the predicted speed and the periodicity of the speed data collection are configurable. [Item 15] 1. A computer system for program performance anomaly detection, comprising: periodically receiving rate data from a workload manager for one or more address spaces; generating a predicted speed value for each of the one or more address spaces; comparing a factor of the predicted speed value with a current speed value from the speed data; taking corrective action based on said current speed value being lower than said factor, indicating an anomaly; A computer system comprising: [Item 16] Item 16. The computer system of item 15, wherein the rate data is received in near real time, real time, or batches. [Item 17] 17. The computer system of claim 15 or 16, wherein the current speed value is calculated by multiplying the used samples by 100 and dividing by the sum of the used samples and the delayed samples. [Item 18] Producing the predicted speed value includes inputting the received speed and historical data of the predicted speed into a statistical modeling software package and outputting the predicted speed value. 18. The computer system of any one of items 15 to 17, further comprising: [Item 19] Item 18. The computer system of item 17, wherein the usage samples include all types of processor usage and the delay samples include all types of processor delays, I / O delays, storage delays and queuing delays. [Item 20] 20. The computer system of any one of items 15 to 19, wherein the corrective action includes generating an alert to an automated problem reporting system, the alert including an application identifier such as a name or job number, a server identifier, an indication of the nature of the problem, and any system messages.

Claims

1. 1. A method for program performance anomaly detection, comprising: the computer periodically receiving rate data from the workload manager regarding the processing of the workload in each of the one or more address spaces; generating a predicted rate value for processing a workload in each of the one or more address spaces based on historical data; the computer comparing the predicted speed value factor with a current speed value from the speed data; generating an alert indicating an anomaly based on the current speed value being lower than the factor; A method for providing the above.

2. The method of claim 1 , wherein the velocity data is received in near real time, real time, or batches.

3. 3. The method of claim 1 or 2, wherein the current speed value is calculated by multiplying usage samples by 100 and dividing by the sum of usage samples and delay samples, wherein the usage samples are the number of samples by the workload manager of non-delayed workload processing among the workload processing in the one or more address spaces being measured, and the delay samples are the number of samples by the workload manager of delayed workload processing among the workload processing in the one or more address spaces being measured.

4. The step of generating the predicted velocity values includes the steps of the computer inputting the historical data into a statistical modeling software package, and the computer outputting the predicted velocity values. The method of any one of claims 1 to 3, further comprising:

5. 4. The method of claim 3, wherein the usage samples include all types of processor usage and the delay samples include all types of processor delays, I / O delays, storage delays and queuing delays.

6. 6. The method of claim 1, wherein the alert is an alert to an automated problem reporting system, the alert including an application identifier such as a name or job number, a server identifier, an indication of the nature of the problem, and any system messages.

7. The method of claim 1 , wherein the factor of the predicted speed and the period for collecting the speed data are configurable.

8. 1. A computer program for program performance anomaly detection, comprising: periodically receiving rate data from a workload manager regarding the processing of a workload in each of one or more address spaces; generating a predicted rate value for processing a workload in each of the one or more address spaces based on historical data; comparing a factor of the predicted speed value with a current speed value from the speed data; and generating an alert indicating an anomaly based on the current speed value being lower than the factor.

9. The computer program of claim 8 , wherein the velocity data is received in near real time, real time, or batches.

10. 10. The computer program product of claim 8 or 9, wherein the current speed value is calculated by multiplying usage samples by 100 and dividing by the sum of usage samples and delay samples, wherein the usage samples are the number of samples taken by the workload manager of non-delayed workload processing among the workload processing in the one or more address spaces being measured, and the delay samples are the number of samples taken by the workload manager of delayed workload processing among the workload processing in the one or more address spaces being measured.

11. The step of generating the predicted velocity values includes inputting the historical data into a statistical modeling software package and outputting the predicted velocity values.

11. A computer program according to any one of claims 8 to 10, further comprising:

12. 11. The computer program product of claim 10, wherein the usage samples include all types of processor usage and the delay samples include all types of processor delays, I / O delays, storage delays and queuing delays.

13. 13. The computer program product of claim 8, wherein the alert is an alert to an automated problem reporting system, the alert including an application identifier such as a name or job number, a server identifier, an indication of the nature of the problem, and any system messages.

14. 14. The computer program of claim 8, wherein the factor of the predicted speed and the periodicity of the speed data collection are configurable.

15. 1. A computer system for program performance anomaly detection, comprising: periodically receiving rate data from a workload manager regarding processing of a workload in each of one or more address spaces; generating a predicted rate value for processing a workload in each of the one or more address spaces based on historical data; comparing the predicted speed value factor with a current speed value from the speed data; generating an alert indicating an anomaly based on the current speed value being lower than the factor; and A computer system comprising:

16. 16. The computer system of claim 15, wherein the velocity data is received in near real time, real time, or batches.

17. 17. The computer system of claim 15 or 16, wherein the current speed value is calculated by multiplying usage samples by 100 and dividing by the sum of usage samples and delay samples, wherein the usage samples are the number of samples taken by the workload manager of non-delayed workload processing among the workload processing in the one or more address spaces being measured, and the delay samples are the number of samples taken by the workload manager of delayed workload processing among the workload processing in the one or more address spaces being measured.

18. Producing the predicted velocity values includes inputting the historical data into a statistical modeling software package and outputting the predicted velocity values.

18. The computer system of claim 15, further comprising:

19. 18. The computer system of claim 17, wherein the usage samples include all types of processor usage and the delay samples include all types of processor delays, I / O delays, storage delays and queuing delays.

20. 20. The computer system of claim 15, wherein the alert is an alert to an automated problem reporting system, the alert including an application identifier such as a name or job number, a server identifier, an indication of the nature of the problem, and any system messages.

Images