Methods and systems to detect and classify changes in a distributed computing system

    公开(公告)号:US10402253B2

    公开(公告)日:2019-09-03

    申请号:US15607944

    申请日:2017-05-30

    Applicant: VMware, Inc.

    Abstract: Methods and systems are directed to detecting and classifying changes in a distributed computing system. Divergence value are computed from distributions of different types of event messages generated in time intervals of a sliding time window. Each divergence value is a measure of change in types of events generated in each time interval. When a divergence value, or a rate of change in divergence values, exceeds a threshold, the time interval associated with the threshold violation is used to determine a change point in the operation of the distributed computing system. Based on the change point, a start time of the change is determined. The change is classified based on various previously classified change points in the disturbed computing system. A recommendation may be generated to address the change based on the classification of the change.

    Methods and systems that use volatile event types in log files to narrow a search for potential sources of problems in a distributed computing system

    公开(公告)号:US10268534B2

    公开(公告)日:2019-04-23

    申请号:US15366640

    申请日:2016-12-01

    Applicant: VMware, Inc.

    Abstract: Methods and systems to narrow a search for potential sources of problems in a distributed computing system are described. A volatile event type of event messages recorded in an event-log file is identified. The volatile event type is an event type that may have unexpectedly increased in frequency over an observation time window. An historical period of time may be selected to search for potential sources of the volatile event type. Frequencies of event messages in the event-log file with the same event type as the volatile event type are determined for time intervals of the historical period of time. A time interval of the historical period of time with a largest increase in frequency of event messages is identified. A list of event messages of the event-log file in a selected sub-time interval of the sub-time intervals of the time interval are displayed in a graphical user interface.

    METHODS AND SYSTEMS TO ADJUST RESOURCES AND MONITORING CONFIGURATION OF OBJECTS IN A DISTRIBUTED COMPUTING SYSTEM

    公开(公告)号:US20180367434A1

    公开(公告)日:2018-12-20

    申请号:US15628333

    申请日:2017-06-20

    Applicant: VMware, Inc.

    Abstract: Methods and systems automatically adjusting resources and monitoring configurations of objects of a distributed computing system in response to changes to application programs. Methods search event messages for information indicating a change in execution of an object. The information is used to determine resource allocation rules of infrastructure resources by and a monitoring configuration for the object. Expected impacts on the infrastructure resource are determined from the rules. When an expected impact is greater than an associated impact threshold, use of the infrastructure resources may be adjusted to accommodate the changes. The adjustments include scaling up or down the infrastructure resources. When the object is a virtual object, the virtual object may be migrated from one server computer to another server computer within the distributed computer system. The monitoring configuration is used to adjust tools that monitor the objects of the distributed computing system.

    METHODS AND SYSTEMS TO DETECT AND CLASSIFY CHANGES IN A DISTRIBUTED COMPUTING SYSTEM

    公开(公告)号:US20180349221A1

    公开(公告)日:2018-12-06

    申请号:US15607944

    申请日:2017-05-30

    Applicant: VMware, Inc.

    CPC classification number: G06F11/0781 G06F11/0754 G06F11/079

    Abstract: Methods and systems are directed to detecting and classifying changes in a distributed computing system. Divergence value are computed from distributions of different types of event messages generated in time intervals of a sliding time window. Each divergence value is a measure of change in types of events generated in each time interval. When a divergence value, or a rate of change in divergence values, exceeds a threshold, the time interval associated with the threshold violation is used to determine a change point in the operation of the distributed computing system. Based on the change point, a start time of the change is determined. The change is classified based on various previously classified change points in the disturbed computing system. A recommendation may be generated to address the change based on the classification of the change.

    Methods and systems to identify log write instructions of a source code as sources of event messages

    公开(公告)号:US10061566B2

    公开(公告)日:2018-08-28

    申请号:US15286291

    申请日:2016-10-05

    Applicant: VMware, Inc.

    CPC classification number: G06F9/542 G06F9/5077 G06F11/362

    Abstract: Methods and systems to identify log write instructions of a source code as potential sources of an event message of interest are described. Methods identify non-parametric tokens, such as text strings and natural language words and phrases, of an event message of interest. Candidate log write instructions and associated line numbers in a source code are identified. Non-parametric tokens of each event message of the one or more candidate log write instructions are determined. A confidence score is calculated for each candidate log write instruction based the number of non-parametric tokens the event message of interest and event message of the candidate log write instruction have in common. The candidate log write instructions are rank ordered based on the corresponding one or more confidence scores and the rank ordered candidate log write instructions and associated line numbers of the source code may be displayed in a graphical user interface.

    Probability-distribution-based log-file analysis

    公开(公告)号:US11048608B2

    公开(公告)日:2021-06-29

    申请号:US14660461

    申请日:2015-03-17

    Applicant: VMware, Inc.

    Abstract: The current document is directed to systems, and methods incorporated within the systems, that carry out probability-distribution-based analysis of log-file entries. A monitoring subsystem within a distributed computer system uses probability-distribution-based analysis of log-file entries to detect changes in the state of the distributed computer system. A log-file-analysis subsystem within a distributed computer system uses probability-distribution-based analysis of log-file entries to identify subsets of log-file entries that predict anomalies and impending problems in the distributed computer system. In many implementations, a numerical comparison of probability distributions of log-file-entry types is used to detect state changes in the distributed computer system.

    Methods and systems that detect and classify incidents and anomalous behavior using metric-data observations

    公开(公告)号:US10997009B2

    公开(公告)日:2021-05-04

    申请号:US16214272

    申请日:2018-12-10

    Applicant: VMware, Inc

    Abstract: The current document is directed to methods and systems for detecting the occurrences of abnormal events and operational behaviors within the distributed computer system. The currently described methods and systems continuously collect metric data from various metric-data sources, generate a sequence of metric-data observations, each metric-data observation comprising a set of temporally aligned metric data, and employ principle-component analysis to transform the metric-data observations to facilitate reduction of the dimensionality of the metric-data observations. The currently described methods and systems then employ clustering methods to identify outlying transformed-metric-data observations, accordingly label the transformed metric-data observations to generate a training dataset, and then apply one or more of various types of machine-learning techniques to the training dataset in order to generate an abnormal-observation detector that can be used to detect, in real time, abnormal metric-data observations as they are generated within the distributed computing system.

    Method and system for identifying event-message transactions

    公开(公告)号:US10810103B2

    公开(公告)日:2020-10-20

    申请号:US15379005

    申请日:2016-12-14

    Applicant: VMware, Inc.

    Abstract: The current document is directed to methods and systems that process, classify, efficiently store, and display large volumes of event messages generated in modern computing systems. In a disclosed implementation, event messages are assigned types and transformed into event records with well-defined fields that contain field values. Recurring patterns of event messages, referred to as “transactions,” are identified within streams or sequences of time-associated event messages and streams or sequences of time-associated event records.

Patent Agency Ranking