Abstract: Aspects of the invention include a computer-implemented method by executing, via a processor, a bottleneck model training process for microservices in a microservice system, wherein for each of the microservices the bottleneck model training process filters out a subset of training data based at least in part on a current situation setting. Building, via the processor, a bottleneck indicator model for each of the microservices using information from the bottleneck model training process, convergence points for an expected response time. Executing, via the processor, a bottleneck identification process for providing system alerts when a bottleneck is identified, wherein the bottleneck identification process uses analysis to monitor a data stream according to the bottleneck indicator model which uses the convergence points for response times.

Abstract: In an approach, a processor obtains a first set of training samples, one of the training samples including values of a plurality of performance indicators of a target system observed at a historical point in time. A processor determines whether the first set of training samples are qualified for training a prediction model, the prediction model predicting an operational status of the target system at a target point in time based on values of the plurality of performance indicators observed at the target point in time. A processor, in response to determining that the first set of training samples are qualified for training the prediction model, trains, the prediction model based on the first set of training samples.

Abstract: According to one or more embodiments of the present invention a computer-implemented method includes receiving a transaction-data for a transaction that occurs in a particular time-interval. The method further includes comparing a set of parameters from the transaction-data with a performance profile associated with the particular time-interval. The method further includes based on determining that the transaction is a deviant transaction, forwarding the transaction-data to a first data collector. The method further includes based on determining that the transaction is a conventional transaction, forwarding the transaction-data to a second data collector.

Abstract: A computer-implemented method for recommending a monitoring interval in provided. A non-limiting example of the computer-implemented method includes receiving, by a processor, monitoring data at an initial monitoring interval and calculating, by the processor, a set of aggregation data from the monitoring data including a first subset of aggregation data at a first interval of the initial monitoring interval. The method calculates, by the processor, a first density score for the first subset of aggregation data and a first indicator score for the first subset of aggregation data and provides, by the processor, the first interval as a recommended interval when the first density score does not exceed a density threshold and the first indicator threshold does not exceed an indicator threshold.

Abstract: Embodiments include cognitive control of runtime resource monitoring scope. Aspects include obtaining historical data for each of a plurality of metrics for a computer system and calculating, based on the historical data, an anomaly relationship score for each of the plurality of metrics. Aspects also include calculating, based on the historical data, a sensitivity score for each of the plurality of metrics and determining a priority score for each of the plurality of metrics based upon a weighted combination of the anomaly relationship score and the priority score. Aspects further include receiving real-time data for each of the plurality of metrics and presenting a subset of the real-time data to a user, the subset created by selecting one or more of the plurality of metrics based on the priority score of each of the plurality of metrics.

Abstract: Embodiments include cognitive control of runtime resource monitoring scope. Aspects include obtaining historical data for each of a plurality of metrics for a computer system and calculating, based on the historical data, an anomaly relationship score for each of the plurality of metrics. Aspects also include calculating, based on the historical data, a sensitivity score for each of the plurality of metrics and determining a priority score for each of the plurality of metrics based upon a weighted combination of the anomaly relationship score and the priority score. Aspects further include receiving real-time data for each of the plurality of metrics and presenting a subset of the real-time data to a user, the subset created by selecting one or more of the plurality of metrics based on the priority score of each of the plurality of metrics.

Abstract: Aspects of the invention include detecting and predicting application performance. A non-limiting example computer-implemented method includes receiving source code and generating a first model of the source code by labeling a word of the source code. The computer implemented method optimizes the first model of the source code by assembling the first model of the source code with a plurality of models generated by a model generation module into a second model of the source code and extracts at least two basic features from the second model of the source code. The computer-implemented method provides an estimated performance of the source code based on historical data of the basic features extracted from the second model of the source code.

Abstract: A computer system to detect data alerts includes a data preprocessing system and a data analysis system. The data preprocessing system obtains system data of the computer system, generates predicted data based on the system data, and generates differential data indicating a difference between the system data and the predicted data. The data analysis is in signal communication with the data preprocessing system and determines that the differential data is one of expected event or an anomaly event in response to adding at least one new value from the differential data to the predicted data.

Abstract: Techniques for data storage strategy determination are described herein. An aspect includes determining a plurality of file classifications for files that are stored in a data storage system based on performance history data of a disaster recovery (DR) system of the data storage system. Another aspect includes determining classification records and performance records for the DR system based on the plurality of file classifications. Another aspect includes determining an information loss based on the performance records. Another aspect includes determining a total cost savings based on the classification records. Another aspect includes determining a recommended recovery time objective (RTO)/recovery point objective (RPO) strategy based on the information loss and the total cost savings. Another aspect includes implementing the recommended RTO/RPO strategy in the DR system.

Abstract: In an approach, a processor obtains a first set of training samples, one of the training samples including values of a plurality of performance indicators of a target system observed at a historical point in time. A processor determines whether the first set of training samples are qualified for training a prediction model, the prediction model predicting an operational status of the target system at a target point in time based on values of the plurality of performance indicators observed at the target point in time. A processor, in response to determining that the first set of training samples are qualified for training the prediction model, trains, the prediction model based on the first set of training samples.

Abstract: Techniques for data storage strategy determination are described herein. An aspect includes determining a plurality of file classifications for files that are stored in a data storage system based on performance history data of a disaster recovery (DR) system of the data storage system. Another aspect includes determining classification records and performance records for the DR system based on the plurality of file classifications. Another aspect includes determining an information loss based on the performance records. Another aspect includes determining a total cost savings based on the classification records. Another aspect includes determining a recommended recovery time objective (RTO)/recovery point objective (RPO) strategy based on the information loss and the total cost savings. Another aspect includes implementing the recommended RTO/RPO strategy in the DR system.

Abstract: Aspects of the invention include a computer-implemented method by executing, via a processor, a bottleneck model training process for microservices in a microservice system, wherein for each of the microservices the bottleneck model training process filters out a subset of training data based at least in part on a current situation setting. Building, via the processor, a bottleneck indicator model for each of the microservices using information from the bottleneck model training process, convergence points for an expected response time. Executing, via the processor, a bottleneck identification process for providing system alerts when a bottleneck is identified, wherein the bottleneck identification process uses analysis to monitor a data stream according to the bottleneck indicator model which uses the convergence points for response times.

Abstract: Aspects of the invention include detecting and predicting application performance. A non-limiting example computer-implemented method includes receiving source code and generating a first model of the source code by labeling a word of the source code. The computer implemented method optimizes the first model of the source code by assembling the first model of the source code with a plurality of models generated by a model generation module into a second model of the source code and extracts at least two basic features from the second model of the source code. The computer-implemented method provides an estimated performance of the source code based on historical data of the basic features extracted from the second model of the source code.

Abstract: Methods, systems, and computer program products for identifying relationships among a group of indicators are provided. Aspects include obtaining the group of indicators, including a number of indicators relating to an operation of a computing system. Aspects also include creating pairs of indicators, wherein the pairs of indicators includes all possible combination of the group of indicators. Aspects further include, for each pair of indicators, calculating a linear correlation score, calculating a fitting function score, determining a final correlation score based at least in part on one of the linear correlation score and the fitting function score and storing the final correlation score in a relationship database. Aspects also include creating a graphical display based on the relationship database, wherein the graphical display is configured to convey a strength relationships among the group of indicators.

Abstract: A computer-implanted method for creating a filtered digital entry includes generating, via a processor implementing a trace generation engine, a trace indicative of successful transactions and erroneous transactions. The processor instantiates a plurality of buffers in a buffer pool each configured to record a trace function boundary. The processor then analyzes each buffer in the buffer pool based on the trace function boundary to evaluate whether each function entry in the trace contains an erroneous transaction. If the processor determines that a function entry contains an erroneous transaction, the processor sets an output flag in a call stack map associated with that function. The processor then generates a filtered digital entry based on the call stack map. The filtered digital entry includes only erroneous transaction data from the trace.

Abstract: A computer-implemented method for recommending a monitoring interval in provided. A non-limiting example of the computer-implemented method includes receiving, by a processor, monitoring data at an initial monitoring interval and calculating, by the processor, a set of aggregation data from the monitoring data including a first subset of aggregation data at a first interval of the initial monitoring interval. The method calculates, by the processor, a first density score for the first subset of aggregation data and a first indicator score for the first subset of aggregation data and provides, by the processor, the first interval as a recommended interval when the first density score does not exceed a density threshold and the first indicator threshold does not exceed an indicator threshold.

Abstract: According to one or more embodiments of the present invention a computer-implemented method includes receiving a transaction-data for a transaction that occurs in a particular time-interval. The method further includes comparing a set of parameters from the transaction-data with a performance profile associated with the particular time-interval. The method further includes based on determining that the transaction is a deviant transaction, forwarding the transaction-data to a first data collector. The method further includes based on determining that the transaction is a conventional transaction, forwarding the transaction-data to a second data collector.

Abstract: A computer system to detect data alerts includes a data preprocessing system and a data analysis system. The data preprocessing system obtains system data of the computer system, generates predicted data based on the system data, and generates differential data indicating a difference between the system data and the predicted data. The data analysis is in signal communication with the data preprocessing system and determines that the differential data is one of expected event or an anomaly event in response to adding at least one new value from the differential data to the predicted data.

Abstract: Methods, systems, and computer program products for identifying relationships among a group of indicators are provided. Aspects include obtaining the group of indicators, including a number of indicators relating to an operation of a computing system. Aspects also include creating pairs of indicators, wherein the pairs of indicators includes all possible combination of the group of indicators. Aspects further include, for each pair of indicators, calculating a linear correlation score, calculating a fitting function score, determining a final correlation score based at least in part on one of the linear correlation score and the fitting function score and storing the final correlation score in a relationship database. Aspects also include creating a graphical display based on the relationship database, wherein the graphical display is configured to convey a strength relationships among the group of indicators.

Abstract: A computer-implanted method for creating a filtered digital entry includes generating, via a processor implementing a trace generation engine, a trace indicative of successful transactions and erroneous transactions. The processor instantiates a plurality of buffers in a buffer pool each configured to record a trace function boundary. The processor then analyzes each buffer in the buffer pool based on the trace function boundary to evaluate whether each function entry in the trace contains an erroneous transaction. If the processor determines that a function entry contains an erroneous transaction, the processor sets an output flag in a call stack map associated with that function. The processor then generates a filtered digital entry based on the call stack map. The filtered digital entry includes only erroneous transaction data from the trace.