An approach to predictive detection for service management

Service providers typically define quality of service problems using threshold tests, such as "are HTTP operations greater than 12 per second on server XYZ?" This paper explores the feasibility of predicting violations of threshold tests. Such a capability would allow providers to take corrective actions in advance of service disruptions. Our approach estimates the probability of threshold violations for specific times in the future. We modeled the threshold metric (e.g., HTTP operations per second) at two levels: (1) nonstationary behavior (as is done in workload forecasting for capacity planning) and (2) stationary, time-serial dependencies. Using these models, we compute the probability of threshold violations. We asses our approach using measurements of HTTP operations per second collected from a production Web server. These assessments suggest that our approach works well if: (a) the actual values of predicted metrics are sufficiently distant from their thresholds; and/or (b) the prediction horizon is not too far into the future.