Patent ID: 7395187

Claim:
An abnormality detection device for a system with a plurality of components, said abnormality detection device comprising: a server comprising a processor; a plurality of agents in communication with said components and with said server and wherein said agents are adapted to periodically determine current performance/workload measurements for each of said components and to periodically transmit said current performance/workload measurements to said server; and a data storage device in communication with said server; wherein said processor is adapted to dynamically compile a history of performance/workload measurements for each of said components and to compare said current performance/workload measurement for each of said components to said history for each of said components so as to detect an abnormality, wherein said data storage device stores said current performance/workload measurements for each of said components, said history for each of said components, and a record of detected abnormalities for each of said components, wherein said processor is further adapted to compile said history by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters, wherein each of said performance/workload measurements comprises a workload value, and wherein for each of said components said processor is adapted to detect an abnormality by: identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement; determining a combined average of said predetermined number of said average performance/workload measurements; and determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.