Abstract: Some embodiments of the invention provide a method for collecting metric values relating to operations of a set of one or more resources executing on host computers in a datacenter. In some embodiments, the method hierarchically collects and analyzes samples, with a first set of samples collected and analyzed in the data plane, and a second set of samples collected and analyzed in the control plane by aggregating the samples collected in the data plane. In some embodiments, the data plane includes host computers on which sample collecting engines (e.g., service engines) execute, while the control plane includes a set of one or more servers that obtains sample data collected by the host computers, and aggregates and analyzes this data.

Abstract: Some embodiments provide a novel method for dynamically adjusting sampling rates of a middlebox service. In some embodiments, the method is performed by the controller. The method configures the forwarding element to collect samples from packets processed by the forwarding element at a first sampling rate. The method analyzes the samples in order to collect information regarding the packets processed by the forwarding element. Based on the analysis, the method detects a new traffic pattern in the packets processed by the forwarding element. The method then configures the forwarding element to collect samples from packets processed by the forwarding element at a second sampling rate different than the first sampling rate.

Abstract: Described are systems and methods for automatically generating, by a computing device, a regular expression that matches a list of input strings. A method includes identifying a set of baseline regular expression classes that match a portion of an input string of the list of input strings. The method further generates a current regular expression as a sequence of baseline regular expression classes from the set of baseline regular expression classes based on matching baseline regular expression classes to characters of a first input string of the list of input strings. The method further determines whether the current regular expression matches all input strings of the list of input strings, and if it does not, the method regenerates a portion of the current regular expression that occurs after an earliest character, in order, of one of the one or more input strings, that does not match the current regular expression.

Abstract: Managing performance metrics includes: obtaining a plurality of performance metrics associated with a plurality of sources on a network; aggregating, at a first rate, the plurality of performance metrics associated with the plurality of sources to generate a plurality of first aggregated results; maintaining at least some of the plurality of first aggregated results in one or more memories; aggregating, at a second rate, the plurality of first aggregated results to generate a plurality of second aggregated results, the second rate being a lower rate than the first rate; and maintaining at least some of the plurality of second aggregated results in the one or more memories.

Abstract: Autoscaling comprises: accessing operational data associated with a pool of servers; determining an expected load associated with a service provided by the pool of servers based at least in part on the operational data; determining an estimated capacity associated with the service provided by the pool of servers; determining that an autoscale operation is to be performed based at least in part on the expected load and the estimated capacity, wherein the autoscale operation automatically scales out one or more additional servers or automatically scales in one or more servers in the pool of servers; and performing the autoscale operation.

Abstract: Some embodiments of the invention provide a method for collecting metric values relating to operations of a set of one or more resources executing on host computers in a datacenter. In some embodiments, the method hierarchically collects and analyzes samples, with a first set of samples collected and analyzed in the data plane, and a second set of samples collected and analyzed in the control plane by aggregating the samples collected in the data plane. In some embodiments, the data plane includes host computers on which sample collecting engines (e.g., service engines) execute, while the control plane includes a set of one or more servers that obtains sample data collected by the host computers, and aggregates and analyzes this data.

Abstract: Managing performance metrics includes: obtaining a plurality of performance metrics associated with a plurality of sources on a network; aggregating, at a first rate, the plurality of performance metrics associated with the plurality of sources to generate a plurality of first aggregated results; maintaining at least some of the plurality of first aggregated results in one or more memories; aggregating, at a second rate, the plurality of first aggregated results to generate a plurality of second aggregated results, the second rate being a lower rate than the first rate; and maintaining at least some of the plurality of second aggregated results in the one or more memories.

Abstract: Described are systems and methods for automatically generating, by a computing device, a regular expression that matches a list of input strings. A method includes identifying a set of baseline regular expression classes that match a portion of an input string of the list of input strings. The method further generates a current regular expression as a sequence of baseline regular expression classes from the set of baseline regular expression classes based on matching baseline regular expression classes to characters of a first input string of the list of input strings. The method further determines whether the current regular expression matches all input strings of the list of input strings, and if it does not, the method regenerates a portion of the current regular expression that occurs after an earliest character, in order, of one of the one or more input strings, that does not match the current regular expression.

Abstract: Some embodiments of the invention provide a method for collecting metric values relating to operations of a set of one or more resources executing on host computers in a datacenter. In some embodiments, the method hierarchically collects and analyzes samples, with a first set of samples collected and analyzed in the data plane, and a second set of samples collected and analyzed in the control plane by aggregating the samples collected in the data plane. In some embodiments, the data plane includes host computers on which sample collecting engines (e.g., service engines) execute, while the control plane includes a set of one or more servers that obtains sample data collected by the host computers, and aggregates and analyzes this data.

Abstract: Some embodiments of the invention provide a method for collecting metric values relating to operations of a set of one or more resources executing on host computers in a datacenter. In some embodiments, the method hierarchically collects and analyzes samples, with a first set of samples collected and analyzed in the data plane, and a second set of samples collected and analyzed in the control plane by aggregating the samples collected in the data plane. In some embodiments, the data plane includes host computers on which sample collecting engines (e.g., service engines) execute, while the control plane includes a set of one or more servers that obtains sample data collected by the host computers, and aggregates and analyzes this data.

Abstract: A custom metrics technique includes: accessing a packet; processing the packet using a packet processing pipeline of a service engine in a distributed network service platform, including: reaching a pre-specified point in the packet processing pipeline; inserting, in the packet processing pipeline, script code that corresponds to the pre-specified point; executing the script code to collect at least metric-related data associated with a user-specified metric object; and executing remaining packet processing pipeline.

Abstract: Autoscaling comprises: accessing operational data associated with a pool of servers; determining an expected load associated with a service provided by the pool of servers based at least in part on the operational data; determining an estimated capacity associated with the service provided by the pool of servers; determining that an autoscale operation is to be performed based at least in part on the expected load and the estimated capacity, wherein the autoscale operation automatically scales out one or more additional servers or automatically scales in one or more servers in the pool of servers; and performing the autoscale operation.

Abstract: Determining and presenting traffic patterns includes: obtaining a first set of traffic metrics pertaining to network traffic associated with a plurality of containers of a container-based cloud computing platform, wherein: the plurality of containers supports a plurality of microservices; and a microservice has one or more corresponding microservice instances that execute on one or more of the plurality of containers; transforming the first set of traffic metrics into a second set of traffic metrics, the second set of traffic metrics comprising network traffic information pertaining to at least some of the plurality of microservices, the transformation being based at least in part on information pertaining to the plurality of containers and the plurality of microservices supported by the plurality of containers; constructing a microservice map based on the second set of traffic metrics; and outputting the microservice map.

Abstract: Some embodiments of the invention provide a method for collecting metric values relating to operations of a set of one or more resources executing on host computers in a datacenter. In some embodiments, the method hierarchically collects and analyzes samples, with a first set of samples collected and analyzed in the data plane, and a second set of samples collected and analyzed in the control plane by aggregating the samples collected in the data plane. In some embodiments, the data plane includes host computers on which sample collecting engines (e.g., service engines) execute, while the control plane includes a set of one or more servers that obtains sample data collected by the host computers, and aggregates and analyzes this data.

Abstract: Some embodiments of the invention provide a method for collecting metric values relating to operations of a set of one or more resources executing on host computers in a datacenter. In some embodiments, the method hierarchically collects and analyzes samples, with a first set of samples collected and analyzed in the data plane, and a second set of samples collected and analyzed in the control plane by aggregating the samples collected in the data plane. In some embodiments, the data plane includes host computers on which sample collecting engines (e.g., service engines) execute, while the control plane includes a set of one or more servers that obtains sample data collected by the host computers, and aggregates and analyzes this data.

Abstract: In an embodiment, a process for preventing distributed denial of service attacks in real-time includes sending received packets to a learning manager to detect a change in a traffic pattern. In response to the learning manager detecting the change in the traffic pattern, the process determines a set of Top-N analysis fields that corresponds to the change in the traffic pattern. The process performs Top-N analysis on received packets to determine a set of values associated with the set of Top-N analysis fields. The process obtains an updated policy based at least in part on the set of values, and checks incoming packets against the updated policy.

Abstract: Autoscaling comprises: accessing operational data associated with a pool of servers; determining an expected load associated with a service provided by the pool of servers based at least in part on the operational data; determining an estimated capacity associated with the service provided by the pool of servers; determining that an autoscale operation is to be performed based at least in part on the expected load and the estimated capacity, wherein the autoscale operation automatically scales out one or more additional servers or automatically scales in one or more servers in the pool of servers; and performing the autoscale operation.

Abstract: A method for evaluating health of a distributed network service environment (DNSE) includes determining an application performance measurement (APM) based at least in part on performance metrics (PM) associated with sources, where the sources are associated with the DNSE. The sources include service engine(s) and servers. At least some of the servers are configured to provide a distributed application, and the service engine(s) are configured to provide the servers with a network service and collect at least a part of the PM. The method includes determining a health risk of the DNSE based at least in part on risk parameters obtained by the service engine(s). The method includes combining the APM and the health risk of the DNSE to determine a health indicator. If the indicator indicates a change of the DNSE, a notification of the change is generated. The method includes outputting the notification of the change.

Abstract: Determining and presenting traffic patterns includes: obtaining a first set of traffic metrics pertaining to network traffic associated with a plurality of containers of a container-based cloud computing platform, wherein: the plurality of containers supports a plurality of microservices; and a microservice has one or more corresponding microservice instances that execute on one or more of the plurality of containers; transforming the first set of traffic metrics into a second set of traffic metrics, the second set of traffic metrics comprising network traffic information pertaining to at least some of the plurality of microservices, the transformation being based at least in part on information pertaining to the plurality of containers and the plurality of microservices supported by the plurality of containers; constructing a microservice map based on the second set of traffic metrics; and outputting the microservice map.

Abstract: Determining and presenting traffic patterns includes: obtaining a first set of traffic metrics pertaining to network traffic associated with a plurality of containers of a container-based cloud computing platform, wherein: the plurality of containers supports a plurality of microservices; and a microservice has one or more corresponding microservice instances that execute on one or more of the plurality of containers; transforming the first set of traffic metrics into a second set of traffic metrics, the second set of traffic metrics comprising network traffic information pertaining to at least some of the plurality of microservices, the transformation being based at least in part on information pertaining to the plurality of containers and the plurality of microservices supported by the plurality of containers; constructing a microservice map based on the second set of traffic metrics; and outputting the microservice map.