Systems for alerting in computing systems. A method commences by defining a plurality of analysis zones bounded by respective ranges of system metric values, which ranges in turn correspond a plurality of system behavior classifications. System observations are taken while the computing system is running. A system observation comprising a measured metric value is classified into one or more of the behavior classifications. Based on the classification, one or more alert analysis processes are invoked to analyze the system observation and make a remediation recommendation. An alert or remediation is raised or suppressed based on one or more zone-based analysis outcomes. An alert is raised when anomalous behavior is detected. The system makes ongoing observations to learn how and when to classify a measured metric value into normal or anomalous behaviors. As changes occur in the system configuration, the analysis zones are adjusted to reflect changing bounds of the zones.