A method comprising performing, by a computer system: receiving, by a server computer from one or more client computers, a data value of a data stream that represents the client computer's operational status, the data stream providing a series of data values over time, the series of data values comprising the data value and one or more historical data values that were received in the data stream prior to the data value, wherein the data value represents a metric that is associated with a time interval that is unique within the data stream and each of the one or more historical data values that represent a metric that is associated with a historical time interval; selecting, by the server computer, a plurality of models based on the time interval, wherein each of the plurality of models has a different periodicity; for each model of the plurality of models, generating, by the server computer, a score of a plurality of scores based on the model, wherein generating the score comprises: predicting, by the server computer, a prediction value based on the model, wherein predicting the prediction value comprises feeding, to the model, one or more matching historical data values that match a periodicity of the model; and generating, by the server computer, the score based on the prediction value and the data value; generating, by the server computer, a final score based on the plurality of scores generated from each of the plurality of models; generating, by the server computer, a score threshold; determining, by the server computer, whether the final score exceeds the score threshold; and responsive to determining that the final score exceeds the score threshold, generating, by the server computer, a notification that indicates that the data value is an anomaly and sending the notification to a reporting/command service to cause the reporting/command service to transmit a command message configured to cause the one or more client computers to halt, restart or start one or more software processes. receiving, by a server computer from one or more client computers, a data value of a data stream that represents the client computer's operational status, the data stream providing a series of data values over time, the series of data values comprising the data value and one or more historical data values that were received in the data stream prior to the data value, wherein the data value represents a metric that is associated with a time interval that is unique within the data stream and each of the one or more historical data values that represent a metric that is associated with a historical time interval; selecting, by the server computer, a plurality of models based on the time interval, wherein each of the plurality of models has a different periodicity; for each model of the plurality of models, generating, by the server computer, a score of a plurality of scores based on the model, wherein generating the score comprises: predicting, by the server computer, a prediction value based on the model, wherein predicting the prediction value comprises feeding, to the model, one or more matching historical data values that match a periodicity of the model; and generating, by the server computer, the score based on the prediction value and the data value; predicting, by the server computer, a prediction value based on the model, wherein predicting the prediction value comprises feeding, to the model, one or more matching historical data values that match a periodicity of the model; and generating, by the server computer, the score based on the prediction value and the data value; generating, by the server computer, a final score based on the plurality of scores generated from each of the plurality of models; generating, by the server computer, a score threshold; determining, by the server computer, whether the final score exceeds the score threshold; and responsive to determining that the final score exceeds the score threshold, generating, by the server computer, a notification that indicates that the data value is an anomaly and sending the notification to a reporting/command service to cause the reporting/command service to transmit a command message configured to cause the one or more client computers to halt, restart or start one or more software processes.