In exemplary embodiments, a computer system detects performance anomalies for user computer services. Physical databases convert physical database KPIs into logical database KPI vectors for individual user services and individual time intervals. Physical application servers convert physical application server KPIs into logical application server KPI vectors for the individual user services and time intervals. Physical web servers convert physical web server KPIs into logical web server KPI vectors for the individual user services and time intervals. A KPI server combines the logical database KPI vectors, the logical application server KPI vectors, and the logical web server KPI vectors for individual time intervals into user service KPI vectors for the individual user services during the time intervals. The KPI server detects outlier user service KPI vectors as compared to normal user service KPI vectors and indicates corresponding computer performance anomalies for the user services.