How Industry Tackles Anomalies during Runtime: Approaches and Key Monitoring Parameters

Deviations from expected behavior during runtime, known as anomalies, have\nbecome more common due to the systems' complexity, especially for\nmicroservices. Consequently, analyzing runtime monitoring data, such as logs,\ntraces for microservices, and metrics, is challenging due to the large volume\nof data collected. Developing effective rules or AI algorithms requires a deep\nunderstanding of this data to reliably detect unforeseen anomalies. This paper\nseeks to comprehend anomalies and current anomaly detection approaches across\ndiverse industrial sectors. Additionally, it aims to pinpoint the parameters\nnecessary for identifying anomalies via runtime monitoring data.\n Therefore, we conducted semi-structured interviews with fifteen industry\nparticipants who rely on anomaly detection during runtime. Additionally, to\nsupplement information from the interviews, we performed a literature review\nfocusing on anomaly detection approaches applied to industrial real-life\ndatasets.\n Our paper (1) demonstrates the diversity of interpretations and examples of\nsoftware anomalies during runtime and (2) explores the reasons behind choosing\nrule-based approaches in the industry over self-developed AI approaches.\nAI-based approaches have become prominent in published industry-related papers\nin the last three years. Furthermore, we (3) identified key monitoring\nparameters collected during runtime (logs, traces, and metrics) that assist\npractitioners in detecting anomalies during runtime without introducing bias in\ntheir anomaly detection approach due to inconclusive parameters.\n