Patent ID: 7894350

Claim:
A method of system monitoring, comprising: during a sample interval, collecting sample data corresponding to a plurality of system activities, the sample data collected from a plurality of different processing nodes, each processing node being a node through which a plurality of different enterprise networks communicate over a wide area network, the sample data representing normal operations of the plurality of different enterprise networks, the sample data being collected by an authority node that is in communication with the plurality of different processing nodes; subsequent to the sample interval, collecting instances of observed data from the plurality of different enterprise networks, each instance of observed data corresponding to at least some of the plurality of system activities for at least one of the enterprise networks; determining, at the authority node, that at least one instance of the observed data represents the normal operation of a corresponding enterprise network and that at least one other instance of the observed data does not represent the normal operation of the corresponding enterprise network; generating an alert in response to determining that the observed data does not represent the normal operation of the corresponding enterprise network; and logging, for the corresponding enterprise network, only changes in observed data for system activities for which a health status change is indicated by the observed data, the health status change being at least one of a change from normal operation to not normal operation or a change from not normal operation to normal operation.