Patent ID: 7818418

Claim:
A computer-implemented method for detecting anomalous behavior in a distributed system, comprising the following computer-implemented steps: in response to a plurality of subsystems in the distributed system performing processing for a plurality of execution paths: receiving first data which provides metrics for one level of a hierarchy of metrics, and receiving second data which provides metrics for another level of the hierarchy of metrics, lower than the one level, where the first and second data include identifiers of: (a) the plurality of execution paths and (b) components of the plurality of execution paths, including components which are software components of an application, where the software components include software components which execute at a single host computer, and the first and second data include data obtained from instrumentation at the single host computer; processing the first data to determine if the metrics for the one level contain an anomaly; and in response to determining that the metrics for the one level contain an anomaly: performing a drill down process which includes processing the second data to determine if the metrics for the another level contain an anomaly, where the second data is not processed to determine if the metrics for the another level contain an anomaly if the metrics for the one level are not determined to contain an anomaly; reporting the metrics for the one level which are determined to contain an anomaly; and reporting the metrics for the another level if the metrics for the another level are determined to contain an anomaly.