getting to know yourself
1. Find a metric that characterizes the system.
2. Build up a database of normal values for that metric when the system is working as it should.
3. Continually monitor the metric; set off an alarm if it deviates from the database.
4. Test the metric for false positives/negatives.