Take for example, the classic sysstat monitoring package in Linux. By default, it collects data on various system vitals every 10 minutes. Over a period of time, analysis of this data will paint a picture of what the system looks like under normal load. Spikes or dips are likely to occur from time to time, which may or may not be normal.

For instance, after monitoring a web server for a few weeks, it may become evident that load average gradually increases throughout the morning and in the afternoon, before spiking for a few hours in the evening and dropping off before midnight. Depending on the type of website, weekends may experience more traffic than weekdays. This will manifest itself in tools, such as sysstat. This is how the output from sysstat looks:

# sar...