Predictive Models for Proactive Network Management: Application to a Production Web Server

Proactive management holds the promise of taking corrective actions in advance of service disruptions. Achieving this goal requires predictive models so that potential problems can be anticipated.
Our approach to prediction follows the lines of [9] in which HTTP operations per second are studied for a production web server. As in this prior work, we model the HTTP-operations-per-second process as two subprocesses. The first subprocess addresses nonstationary (trend) behavior. This includes time-of-day and day-of-week effects. The second subprocess addresses time series dependencies once the effects of the first subprocess are removed. We refer to this as the residual process and describe it using an AR(2) model (which is employed in the prior work as well).
Herein, we propose enhancements to both models. We enhance the model of nonstationary behavior by: (a) considering the interactions between time-of-day and day-of-week effects and (b) using a low-pass filter to isolate the nonstationary (low frequency) components. This proves to be a better model than the prior work in that our model has a smaller residual variance and it reduces the amount of historical data required to estimate model parameters.
For the residual process, our extensions address several considerations. We use the characteristic function of the AR process to study the predictable steps for a forecast model; that is, the number of steps into the future for which it is meaningful to do predictions. We also analyze the assumptions that error terms of the residual process are Gaussian (an important consideration for estimating the probability of threshold violations). Specifically, the residual process has substantial deviations from a Gaussian distribution at the tails, but it can still be used effectively for predictive detection made within the range of probabilities from .5 to .95. We also show that long-range dependencies remain in the residual process, which impacts our ability to predict the more distant future.