Abstract: An example system includes memory, programmable circuitry, and machine readable instructions to program the programmable circuitry to: obtain utilization metric information corresponding to utilization metrics collected over a time interval, the utilization metrics corresponding to allocated resources utilized by containers, the containers associated with a cluster, obtain a request to generate priority classes for the containers in the cluster, the priority classes indicative of which containers have a greater priority in the cluster, and generate the priority classes for the containers based on the utilization metric information and a count of network interactions corresponding to the containers for the time interval.

Abstract: This disclosure describes how data supporting real-time reporting services can be cached during a log intake process. In particular, instead of caching all the log data being generated by an operational system, only the log data relevant to existing queries associated with the real-time reporting services are cached. In some embodiments, only particular metrics contained within the log data are stored for rapid access by the real-time reporting services.

Abstract: Methods and systems described herein are directed to aggregating and querying log messages. Methods and systems determine event types of log message generated by event sources of the distributed computing system. The event types are aggregated into aggregated records for a shortest time unit and event types are aggregated into aggregated records for longer time units based on the aggregated records associated with the shortest time unit. In response to a query regarding occurrences of an event type in a query time interval, the query time interval is split into subintervals with time lengths that range from the shortest time unit to a longest time unit that lie within the query time interval. The method determines a total event count of occurrences of the event type in the query time interval based on the aggregated records with time stamps in the subintervals. The event count in the query time interval may be used to detect abnormal behavior of the event sources.

Abstract: The current document is directed to methods and systems that efficiently process and store log/event messages generated within distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system or a message-ingestion-and-processing subsystem. The currently disclosed methods and systems employ additional pre-processing steps to identify the types of received log/event messages, monitor event-type-associated log/event-message-usage-delay histories, and employ time-series-analysis-based and/or neural-network-based estimation of event-type-associated log/event-message usage to efficiently store log/event-messages in low-cost and low-latency storage facilities.

Abstract: This disclosure describes how data supporting real-time reporting services can be cached during a log intake process. In particular, instead of caching all the log data being generated by an operational system, only the log data relevant to existing queries associated with the real-time reporting services are cached. In some embodiments, only particular metrics contained within the log data are stored for rapid access by the real-time reporting services.

Abstract: An example system includes memory, programmable circuitry, and machine readable instructions to program the programmable circuitry to: obtain utilization metric information corresponding to utilization metrics collected over a time interval, the utilization metrics corresponding to allocated resources utilized by containers, the containers associated with a cluster, obtain a request to generate priority classes for the containers in the cluster, the priority classes indicative of which containers have a greater priority in the cluster, and generate the priority classes for the containers based on the utilization metric information and a count of network interactions corresponding to the containers for the time interval.

Abstract: The current document is directed to methods and systems that efficiently process log/event messages within and among distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system or a message-ingestion-and-processing system. By including a pre-processing step two identify the type of a received log/event message, and by specifying initial-processing-step criteria with respect to log/event-message types, significant increases in the efficiency of log/event-message preprocessing by message-collector systems and message-ingestion-and-processing systems is achieved.

Abstract: The current document is directed to methods and systems that sample log/event messages for downstream processing by log/event-message systems incorporated within distributed computer facilities. The data-collection, data-storage, and data-querying functionalities of log/event-message systems provide a basis for distributed log-analytics systems which, in turn, provide a basis for automated and semi-automated system-administration-and-management systems. By sampling log/event-messages, rather than processing and storing every log/event-message generated within a distributed computer system, a log/event-message system significantly decreases data-storage-capacity, computational-bandwidth, and networking-bandwidth overheads involved in processing and retaining large numbers of log/event messages that do not provide sufficient useful information to justify these costs.

Abstract: The current document is directed to methods and systems that efficiently cache log/event messages in log/event-message systems incorporated within distributed computer facilities. The log/event-message systems provide the data-collection, data-storage, and data-querying functionalities that provide a basis for distributed log-analytics systems which, in turn, provide a basis for automated and semi-automated system-administration-and-management systems. Efficient caching significantly extends the period of time that networking failures and log/event-message processing delays can be tolerated by log/event-message systems without significant loss of information. Rather than caching individual log/event messages, message collectors that employ the currently disclosed technologies cache information regarding log/event-message types, leading to efficient compression of the cached information.

Abstract: An example apparatus includes memory, and at least one processor to execute instructions to assign first containers to a first cluster and second containers to a second cluster based on the first containers including first allocated resources that satisfy a first threshold number of allocated resources and the second containers including second allocated resources that satisfy a second threshold number of allocated resources, determine a representative interaction count value for a first one of the first containers, the representative interaction count value based on a first network interaction metric corresponding to an interaction between the first one of the first containers and a combination of at least one of the first containers and at least one of the second containers, and generate a priority class for the first one of the first containers based on the representative interaction count value.

Abstract: Disclosed are various embodiments for automating the prediction of workload tenures in datacenter environments. In some embodiments, parameters are identified for a plurality of workloads of a software defined data center. A machine learning model is trained to determine a predicted tenure based on parameters of the workloads. A workload for the software defined data center is configured to include at least one workload parameter. The workload is processed using the trained machine learning model to determine the predicted tenure. An input to the machine learning model includes the at least one workload parameter.

Abstract: The current document is directed to methods and systems that efficiently process and store log/event messages generated within distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system or a message-ingestion-and-processing subsystem. The currently disclosed methods and systems employ additional pre-processing steps to identify the types of received log/event messages, monitor event-type-associated log/event-message-usage-delay histories, and employ time-series-analysis-based and/or neural-network-based estimation of event-type-associated log/event-message usage to efficiently store log/event-messages in low-cost and low-latency storage facilities.

Abstract: Methods and systems that automatically rank log/event messages and log/event-message transactions to facilitate analysis of log/event-messages generated within distributed-computer systems are disclosed. A base-window dataset and current-window dataset are selected for diagnosis of a particular error or failure and processed to generate a transaction sequence for each dataset corresponding to log/event-message traces identified in the datasets. Then, frequencies of occurrence of log/event-message types relative to transaction types are generated for each dataset. From these two sets of relative frequencies of occurrence, changes in the relative frequency of occurrence for each log/event-message-type/transaction-type pair are generated. Normalized scores for log/event-message-type/transaction-type pairs and scores for transaction types are then generated from the changes in the relative frequency of occurrence.

Abstract: The current document is directed to methods and subsystems within distributed log-analytics systems that automatically and autonomously generate indications of log sources for log/event messages received by the distributed log-analytics systems. The log-source indications can be incorporated in tags associated with received log/event messages to facilitate use of log/event-message information and log/event-message-processing tools contained in content packs provided by designers, manufacturers, and vendors of computational entities by log/event-message systems that collect, process, and store large volumes of log/event messages generated by many different types of computational entities within distributed computer systems. Log-source indications are generated by a combination of using currently available log-source indications associated with log/event messages, event-type-clustering based event-type-to-log source mapping, and machine-learning-based event-type-to-log source mapping.

Abstract: Methods and systems described herein are directed to aggregating and querying log messages. Methods and systems determine event types of log message generated by event sources of the distributed computing system. The event types are aggregated into aggregated records for a shortest time unit and event types are aggregated into aggregated records for longer time units based on the aggregated records associated with the shortest time unit. In response to a query regarding occurrences of an event type in a query time interval, the query time interval is split into subintervals with time lengths that range from the shortest time unit to a longest time unit that lie within the query time interval. The method determines a total event count of occurrences of the event type in the query time interval based on the aggregated records with time stamps in the subintervals. The event count in the query time interval may be used to detect abnormal behavior of the event sources.

Abstract: The current document is directed to methods and systems that efficiently and accurately process log/event messages generated within distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system and/or a message-ingestion-and-processing system, including masking sensitive fields to prevent exposure of confidential and sensitive information contained in log/event messages. Rule-based identification and masking of sensitive fields in log/event messages is currently provided by certain automated log/event-message systems, but current approaches suffer numerous deficiencies.

Abstract: A system and method for sampling application programming interface (API) execution traces in a computer system uses feature vectors of the API execution traces that are generated using trace-context information. The feature vectors are then used to group the API execution traces into clusters. For the cluster, sampling rates are generated so that a sampling rate is assigned to each of the clusters. The sampling rates are then applied to the API execution traces to adaptively sample the API execution traces based on the clusters to which the API execution traces belong.

Abstract: The current document is directed to methods and systems that efficiently process log/event messages within and among distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system or a message-ingestion-and-processing system. By including a pre-processing step two identify the type of a received log/event message, and by specifying initial-processing-step criteria with respect to log/event-message types, significant increases in the efficiency of log/event-message preprocessing by message-collector systems and message-ingestion-and-processing systems is achieved.

Abstract: The current document is directed to methods and systems that sample log/event messages for downstream processing by log/event-message systems incorporated within distributed computer facilities. The data-collection, data-storage, and data-querying functionalities of log/event-message systems provide a basis for distributed log-analytics systems which, in turn, provide a basis for automated and semi-automated system-administration-and-management systems. By sampling log/event-messages, rather than processing and storing every log/event-message generated within a distributed computer system, a log/event-message system significantly decreases data-storage-capacity, computational-bandwidth, and networking-bandwidth overheads involved in processing and retaining large numbers of log/event messages that do not provide sufficient useful information to justify these costs.

Abstract: Methods and systems that automatically rank log/event messages and log/event-message transactions to facilitate analysis of log/event-messages generated within distributed-computer systems are disclosed. A base-window dataset and current-window dataset are selected for diagnosis of a particular error or failure and processed to generate a transaction sequence for each dataset corresponding to log/event-message traces identified in the datasets. Then, frequencies of occurrence of log/event-message types relative to transaction types are generated for each dataset. From these two sets of relative frequencies of occurrence, changes in the relative frequency of occurrence for each log/event-message-type/transaction-type pair are generated. Normalized scores for log/event-message-type/transaction-type pairs and scores for transaction types are then generated from the changes in the relative frequency of occurrence.