Detecting abnormalities in time-series data from an online professional network

1. A computer-implemented method for detecting abnormalities in time-series data from an online professional network, the method comprising:

receiving the time-series data, including at least one of throughput measurements and latency measurements associated with requests made to a back-end system associated with the online professional network;

during a transitory startup period for the online professional network, detecting a start of a plain associated with steady-state behavior for requests made to the back-end system by,

using a multi-degree polynomial to compute a best-fit line for throughput measurements for requests made to the backend system, and

if an increase in throughput as indicated by the best-fit line falls below a threshold value, determining that the plain associated with steady state behavior has started;

after the plain associated with steady state behavior has started, attempting to detect an abnormality by examining data points in the plain and looking for a deviation from the best-fit line; and

upon detecting an abnormality in the time-series data in the plain,

looking up associated system metrics which are temporally proximate to the abnormality, and

generating a notification about the abnormality along with the associated system metrics to facilitate determining a root cause of the abnormality.

2. The computer-implemented method of claim 1 , wherein the received time-series data is associated with one or more services that make requests to the back-end system in the online professional network.

3. The computer-implemented method of claim 2 , wherein the one or more services includes one or more of the following:

an email service;

a search service;

a service for accessing home pages;

a service for accessing profile pages; and

a service for interacting with mobile applications.

4. The computer-implemented method of claim 1 , wherein looking up the associated system metrics comprises using a timestamp associated with the abnormality to scan log files containing the system metrics to identify metric values that are temporally proximate to the abnormality.

5. The computer-implemented method of claim 1 , wherein the associated system metrics can includes one or more of the following:

central-processing unit (CPU) usage;

memory utilization;

traffic to disk;

active thread count;

garbage-collection activity;

heap utilization; and

network traffic.

6. The computer-implemented method of claim 1 , wherein detecting the abnormality involves detecting a dip in throughput for the requests made to the back-end system.

7. The computer-implemented method of claim 1 , wherein detecting the abnormality involves detecting a spike in latency for the requests made to the back-end system.

8. The computer-implemented method of claim 1 , wherein the method further comprises generating summary statistics for the time-series data, wherein the summary statistics include one or more of the following:

an average value for the time-series data;

a maximum value for the time-series data;

a minimum value for the time-series data;

a 90 th percentile value for the time-series data; and

a 99 th percentile value for the time-series data.

9. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for detecting abnormalities in time-series data from an online professional network, the method comprising:

receiving the time-series data, including at least one of throughput measurements and latency measurements associated with requests made to a back-end system associated with the online professional network;

during a transitory startup period for the online professional network, detecting a start of a plain associated with steady-state behavior for requests made to the back-end system by,

using a multi-degree polynomial to compute a best-fit line for throughput measurements for requests made to the backend system, and

if an increase in throughput as indicated by the best-fit line falls below a threshold value, determining that the plain associated with steady state behavior has started;

after the plain associated with steady state behavior has started, attempting to detect an abnormality by examining data points in the plain and looking for a deviation from the best-fit line; and

upon detecting an abnormality in the time-series data in the plain,

looking up associated system metrics which are temporally proximate to the abnormality, and

generating a notification about the abnormality along with the associated system metrics to facilitate determining a root cause of the abnormality.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the received time-series data is associated with one or more services that make requests to the back-end system in the online professional network.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the one or more services includes one or more of the following:

an email service;

a search service;

a service for accessing home pages;

a service for accessing profile pages; and

a service for interacting with mobile applications.

12. The non-transitory computer-readable storage medium of claim 9 , wherein looking up the associated system metrics comprises using a timestamp associated with the abnormality to scan log files containing the system metrics to identify metric values that are temporally proximate to the abnormality.

13. The non-transitory computer-readable storage medium of claim 9 , wherein the associated system metrics includes one or more of the following:

central-processing unit (CPU) usage;

memory utilization;

traffic to disk;

active thread count;

garbage-collection activity;

heap utilization; and

network traffic.

14. The non-transitory computer-readable storage medium of claim 9 , wherein detecting the abnormality involves detecting a dip in throughput for the requests made to the back-end system.

15. The non-transitory computer-readable storage medium of claim 9 , wherein detecting the abnormality involves detecting a spike in latency for the requests made to the back-end system.

16. The non-transitory computer-readable storage medium of claim 9 , wherein the method further comprises generating summary statistics for the time-series data, wherein the summary statistics include one or more of the following:

an average value for the time-series data;

a maximum value for the time-series data;

a minimum value for the time-series data;

a 90 th percentile value for the time-series data; and

a 99 th percentile value for the time-series data.

17. A system for detecting abnormalities in time-series data from an online professional network, comprising:

a computing system comprising a processor and a memory;

wherein the computing system is configured to,

receive the time-series data, including at least one of throughput measurements and latency measurements associated with requests made to a back-end system associated with the online professional network;

during a transitory startup period for the online professional network,

use a multi-degree polynomial to compute a best-fit line for throughput measurements for requests made to the backend system, and

if an increase in throughput as indicated by the best-fit line falls below a threshold value, determine that a plain associated with steady state behavior has started;

after the plain associated with steady state behavior has started, attempt to detect an abnormality by examining data points in the plain looking for a deviation from the best-fit line; and

upon detecting an abnormality in the time-series data in the plain,

look up associated system metrics which are temporally proximate to the abnormality; and

generate a notification about the abnormality along with the associated system metrics to facilitate determining a root cause of the abnormality.

18. The system of claim 17 , wherein detecting the abnormality involves detecting a dip in throughput for the requests made to the back-end system.

19. The system of claim 17 , wherein detecting the abnormality involves detecting a spike in latency for the requests made to the back-end system.