Microservices APM Detectors for Anomalous Pattern Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microservices architectures face challenges in efficiently monitoring and troubleshooting due to the complexity of computing metrics from large amounts of span and trace data, and in providing real-time error detection and detailed information to developers.
Innovation Solution
The system ingests up to 100% of span information, groups it by unique identities, computes metrics, and generates metric time series data to provide real-time monitoring and alerting, allowing for anomalous pattern identification and deeper analysis by querying additional datasets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional monitoring tools are used to track microservices performance, then basic symptom-based monitoring is possible, but the system cannot keep up with the dynamic nature of cloud native applications and analyze significant amounts of span and trace data efficiently
Solution Approach 1:
The system segments span data into distinct categories (e.g., by service, operation, status code) and processes each segment independently through specialized detectors. This allows parallel processing of different data types, improving overall throughput while keeping individual processing units manageable in complexity.
Solution Approach 2:
The patent introduces an intermediary layer of detectors that sit between raw span data and the final alerting system. These detectors aggregate and pre-process span information, filtering out noise and preparing data for analysis. This intermediary layer reduces the complexity burden on subsequent processing stages while maintaining high data processing capability.
2Loss of information
If detailed monitoring of all span and trace data is implemented, then comprehensive visibility into application performance is achieved, but computing metrics from large amounts of data becomes inefficient
Solution Approach 1:
The system extracts only the critical information needed for performance monitoring from each span (such as service name, operation type, status code, timing data) while discarding redundant details. This selective extraction maintains essential information for detection while significantly reducing the data volume that requires processing.
Solution Approach 2:
The detectors perform preliminary aggregation and metric computation on span data before it reaches the alerting system. By pre-computing metrics like error rates, latency percentiles, and throughput statistics in advance, the system reduces real-time computational requirements and enables faster response to anomalies.
3Reliability
If real-time alerting is implemented to detect anomalous patterns, then timely issue resolution is enabled, but false alerts and noise in the alert stream increase
Solution Approach 1:
The alerting system dynamically adjusts its detection thresholds and alerting behavior based on current system conditions and historical patterns. Detectors learn from past data to distinguish between transient anomalies and genuine issues, adapting their sensitivity to reduce false alerts while maintaining high detection accuracy for real problems.
Solution Approach 2:
The system incorporates feedback mechanisms where alert outcomes are fed back into the detector training data. This allows detectors to refine their anomaly detection algorithms over time, learning from both false positives and true positives to improve future detection accuracy and reduce unnecessary alerts.
Data Source
AI summary
A method of diagnosing anomalous patterns from metrics data associated with a microservices-based application comprises aggregating a plurality of ingested spans into a plurality of streams of metric data. The method also comprises performing computations on a stream of metric data from the plurality of streams of metric data to identify an anomalous pattern. Further, the method comprises generating an alert in response to the anomalous pattern and querying a data set using metadata associated with the alert to retrieve additional information pertaining to the anomalous pattern.