Abstract: Embodiments detect and group multiple failure events to enable batch processing of those failure events, such as in a virtual datacenter executing a plurality of virtual machines (VMs). A long timer, adaptive short timer, and adaptive polling frequency enable a computing device to efficiently detect and group the failure events that may be related (e.g., resulting from one failure). The grouped failure events are processed in parallel thereby reducing the time for recovery from the failure events.

Abstract: A method and apparatus are provided for building an intelligent automated assistant. Embodiments of the present invention rely on the concept of “active ontologies” (e.g., execution environments constructed in an ontology-like manner) to build and run applications for use by intelligent automated assistants. In one specific embodiment, a method for building an automated assistant includes interfacing a service-oriented architecture that includes a plurality of remote services to an active ontology, where the active ontology includes at least one active processing element that models a domain. At least one of the remote services is then registered for use in the domain.

Abstract: Embodiments include methods, and computer program products of an analytical workflow system. Aspects include: observing analytical workflow patterns of one or more users to gather statistics, predicting an analytical workflow and parameter values likely to be requested in future based on the observations according to a compilation policy, applying a parameter generation policy and preparing the predicted analytical workflows according to the compilation policy, and executing analytical workflows and deploying the executed analytical workflows according to a deployment policy. The aspects also include: refining an analytical workflow specification, reusing prepared, executed or deployed analytical workflows, and terminating one or more prepared, executed or deployed analytical workflows when these analytical workflows are unlikely to be requested by a user in the near future according to a termination policy.

Abstract: DFA construction may be aborted if the DFA will become too big for the computing device to handle or based on user preferences. A DFA may be constructed from an NFA, which is constructed from an expression. The expression may have a total number of operands and operators r. The determination to abort DFA construction may be based on the operands. If the number of DFA nodes constructed is more than a lower threshold and the number of DFA nodes constructed is greater than a function, f(r), the DFA construction may be aborted. If the number of DFA nodes is greater than a higher threshold, the DFA construction may be aborted. The lower threshold may be determined based on computing device capabilities and user preference. The higher threshold may be based on computing device capabilities.

Abstract: The techniques described herein provide for comparison of tree structures. In some examples, a system according to this disclosure may receive at least a first item including a first tree structure and a second item including a second tree structure. The system may compare the first item and the second item. In particular, in performing the comparison, the system may detect a sub-tree structure type in the first tree structure and in the second tree structure. In some examples, the sub-tree structure type is one of one or more sub-tree structure types that have corresponding matching processes. Once determined, the system described herein may perform the corresponding matching process of the detected sub-tree structure type for the first tree structure and the second tree structure.

Abstract: A computer-implemented method for preventing split-brain scenarios in high-availability clusters may include (1) detecting, at a first node of a high-availability cluster, a partitioning event that isolates the first node from a second node of the high-availability cluster, (2) broadcasting, from a health-status server and after the partitioning event has occurred, a cluster-health message to the first node that includes at least a health status of the second node that is based on whether the health-status server received a node-health message from the second node, and (3) reacting, at the first node and based at least in part on whether the first node received the cluster-health message, to the partitioning event such that the partitioning event does not result in a split-brain scenario within the high-availability cluster. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A Cooperative Grid Based Picture Archiving and Communication System (Grid PACS for short) is a multimedia (imaging) medical information archiving, communication and application system used in hospitals. Based on the existing PACS servers, workstations, or other networked multimedia image management systems, it adds and integrates grid-based network functionality into the existing image systems to form new grid-based image communication and management system. It uses service-oriented and event-driven concepts and methods to design and implement a new grid-based image communication and management system to solve the problems encountered in distributing archived image information, coordinating work and managing in a virtually centralized way (Virtual Super-PACS) of different PACS or archiving systems under varied operating environments.

Abstract: This technology relates to a device and method for determining co-locatability of a plurality of virtual machines on one or more physical infrastructures. The plurality of virtual machines hosts a plurality of workloads. This involves identifying workloads which have high variability from the time series data and determining the workload capacity threshold of the identified workloads. Thereafter, the candidate workloads are selected among the identified workloads to colocate on a virtual machine based on the workload variability. After that, the total capacity required by each candidate workload pair to meet the service requirement is determined based on the workload capacity threshold. Then, an optimal sharing point of each workload of the pair with respect to the other workload of the pair is identified. Further, percentage compatibility of each workload pair is determined and finally, the candidate workloads are colocated based on the optimal sharing point and percentage compatibility.

Abstract: Test results can be analyzed and linked using an automated system. In a first embodiment, an error log can be received including log data associated with an error. The log data can be parsed to transform it into a standardized format to allow for easier searching and comparison. Once standardized, an automatic comparison can be made between the parsed log data and previous errors obtained from error logs. If a match is found between the parsed log data and a previous error, then the parsed log data can be linked to the previous error so as to generate a relationship between the two.

Abstract: Systems and techniques are described for analyzing input output I/O traces. One of the techniques includes receiving an I/O trace, the I/O trace identifying a temporal sequence of previously submitted I/O requests; partitioning the I/O trace into a plurality of partitions based on a load pattern of the I/O requests in the I/O trace and a data access pattern of the I/O requests in the I/O trace; and generating a signature for each partition, wherein the signature for each of the partitions identifies characteristics of the I/O requests in the partition, and wherein the characteristics of the I/O requests in the partition include the load pattern of the I/O requests in the partition and the data access pattern of the I/O requests in the partition.

Abstract: An operation management apparatus includes a correlation destruction detection unit and an evaluation value calculation unit. The correlation destruction detection unit detects correlation destruction on a correlation between metrics of two different server among a plurality of servers executed on one or more processing devices in a system. The evaluation value calculation unit calculates and outputs, when correlation destruction on a correlation between two servers has been detected for inputted measurements of metrics, an evaluation value of the correlation destruction on the basis of a relation between the two servers with respect to the correlation on which the correlation destruction has been detected in the system.

Abstract: Methods, systems, and computer program products for providing fair unidirectional multi-queue virtual machine migration are disclosed. A computer-implemented method may include maintaining a current scan identifier for each of a plurality of streams used to migrate a virtual machine from a first hypervisor to a second hypervisor, determining when a current scan identifier of a first stream and a current scan identifier of a second stream are associated with different memory states of the virtual machine, and adjusting processing of memory updates when the current scan identifiers are associated with different memory states of the virtual machine. The adjusting may be performed, for example, by pausing processing on each stream having a current scan identifier subsequent to the earliest current scan identifier determined for the streams, and processing memory updates on each stream having a current scan identifier matching the earliest current scan identifier.

Abstract: Business transactions and the nodes processing the transactions are monitored and actions are applied to one or more nodes when a performance issue is detected. A performance issue may relate to a metric associated with a transaction or node that processes the transaction. If a performance metric determined from data captured by monitoring does not satisfy a health rule, the policy determines which action should be performed to correct the performance of the node. When a problem is detected for multiple nodes, the present technology may address a subset of the multiple nodes rather than apply an action to each node experiencing the problem. When a solution is found to correct the problem with the subset of nodes, the solution may be applied to the other nodes experiencing the same problem.

Abstract: A server system includes a system on chip (SOC), a baseboard management controller (BMC), a first switch and a connector. The SOC has a hardware debugging test (HDT) interface to generate a HDT signal. The BMC has a programming interface to generate a programming signal. The first switch receives the HDT signal and the programming signal. The connector couples with the first switch. A first control signal controls the first switch to select one of the HDT signal and the programming signal to output to the connector. When the connector receives the HDT signal, a debugging apparatus debugs the SOC according to the HDT signal. When the connector receives the programming signal, a programming apparatus performs a programming process for the BMC according to the programming signal.

Abstract: A server. The server comprises a processor, a memory, and an application that receives an alert message corresponding to an error and a performance metric value in a messaging server, wherein the messaging server is one of a plurality of servers in a rotation that supports a front-end application in a system, identifies a course of action for repair, determines that the number of active servers in the rotation is above a predefined threshold number of active servers, removes the messaging server from the rotation, notifies a system administrator of the removal, the identified error, and the performance metric value, repairs the messaging server by implementing the identified course of action, validates the messaging server by running application programming interface (API) calls, places the repaired messaging server in the rotation, and notifies the system administrator of repair details and API call results.

Abstract: A method performed by a monitoring tool in a computer system, the method including: for a set of network nodes in a computer system: applying a correlation formula on an input based on performance data of the set, and determining a correlation score based on applying the correlation formula, the correlation score indicating a correlation between network nodes in the set; determining, based on the correlation scores, a first list including a first plurality of network nodes having a correlation score that satisfies a first threshold; identifying a second plurality of network nodes included in the first list, the second plurality of network nodes having a correlation score that satisfies a second threshold, which indicates a correlation that is higher than the first threshold; analyzing the performance data of the second plurality against a constancy metric; and removing, based on the analyzing, the second plurality from the first list.

Abstract: An apparatus may include a processor and a control plane that directs the processor to (1) detect that at least a portion of an initial branch path of a point-to-multipoint label-switched path has failed over to a failover route that rejoins the initial branch path at a merge-point device and (2) establish an alternate branch path that merges with the initial branch path at the merge-point device. The apparatus may also include a network interface and a data plane that uses the network interface to transmit data via the alternate branch path while data is still being transmitted via the initial branch path, where after the data plane begins transmitting data via the alternate branch path, the control plane instructs the merge-point device to forward data from the alternate branch path rather than from the failover route. Various other apparatuses, systems, and methods are also disclosed.

Abstract: A computer-implemented method is disclosed in which multiple disparate data sources having a different schemas are gathered, and relationships between the data sources are determined. A blended data set is created from the multiple data sources based on the determined relationships. A current behavior of a computing system is determined, with the current behavior being indicative of an anomaly. From the blended data set, historical behaviors of the same computing system or a similar computing system are determined. The current behavior is correlated to the historical behaviors to obtain a correlation, and a response to the anomaly is determined based on the correlation. A complementary computing device and computer program product are also disclosed.

Abstract: A method and system for determining availability of a software application using Composite Hidden Markov Model (CHMM). The software application is divided into a plurality of layers which are further divided into sub-components. The configurations and dependencies of the sub-components are identified and also the state of the sub-components is determined. The state of the sub-components is represented in CHMM using state space diagram. The failure rate and recovery time of the sub-components is computed using the state space diagram and the respective transition tables are derived from the CHMM to determine the availability of the layers. The availability of the layers is combined to determine the availability of the software application.

Abstract: Deleting objects used or managed by an application or application or application instance is disclosed. Second program instructions identify the objects. Second program instructions write an executable program to delete the objects which were identified. Objects than can be deleted include local queues, alias queues, remote queues, security objects, channel objects, process objects, etc. The first program instructions identify a queue object and determine whether the queue object contains a work item. If so, the second program instructions write into the executable program a command to clear the work item. Deleting a queue object managed by an application or application instance is also disclosed. Channels used by other applications or other application instances to lock and access a queue defined by the queue object are identified. Then, the channels are stopped. Afterwards, the work item(s) on the queue are cleared and then the queue object is deleted.

Abstract: Debugging a graphics application executing on a target device. The graphics application may execute CPU instructions to generate graphics commands to graphics hardware for generation of graphics on a display. A breakpoint for the graphics application may be detected at a first time. In response to detecting the breakpoint, one or more graphics commands which were executed by the graphics hardware proximate to the first time may be displayed. Additionally, source code corresponding to CPU instructions which generated the one or more graphics commands may be displayed.

Abstract: In validation of an analyzing apparatus, in the case where the system configuration is not standard or where a reference value required for the validation is different from a standard value, the validation work cannot be automatically performed, which requires time and effort. For a validation target analyzing apparatus system, first, a parameter acquiring unit acquires parameters for qualification implementation of the analyzing apparatus system on a basis of an electronically supplied qualification plan document and an electronically supplied qualification implementation procedure manual. Then, a validation executing unit executes validation of the analyzing apparatus system using the acquired parameters for qualification implementation.

Abstract: Described systems and methods allow a mobile device, such as a smartphone or a tablet computer, to protect a user of the respective device from fraud and/or loss of privacy. In some embodiments, the mobile device receives from a server a risk indicator indicative of whether executing a target application causes a privacy risk. Determining the risk indicator includes automatically supplying a test input to a data field used by the target application, the data field configured to hold a private item such as a password or a geolocation indicator. Determining the risk indicator further comprises determining whether a test device executing an instance of the target application transmits an indicator of the test input, such as the test input itself or a hash of the test input, to another party on the network.

Abstract: An application, peer and method for determining a faulty peer in a structured Peer-to-Peer overlay network. The overlay network includes plural peers besides the faulty peer. The method includes determining that a message sent from a given peer to a target peer along a first path did not reach the target peer; determining an intermediate peer at which the message had arrived; using a second path to send the message from the given peer to the target peer; determining that the message had arrived at the target peer on the second path; adjusting a node identifier (nodeID) of at least one of the target peer and the intermediate peer to obtain a new target peer or a new intermediate peer; and reusing the first and second paths to send the message to the new target peer or the new intermediate peer until the faulty peer is detected.

Abstract: Systems and methods are described for generating a test executable used for testing an application locally on a host device. A user interface allows selection of particular test modules for use. Based on the selected modules a test executable is generated. The test executable functionality may integrated with the application or be independent of the application. The host device executes the test executable which enables testing and debugging on the local device.

Abstract: A processing unit of the embodiments includes an instruction memory that holds a plurality of instructions specified by addresses, and that cannot execute read and write operations concurrently, an error correction circuit that detects and corrects an error in the instruction, a program counter, an instruction buffer that holds the instruction corrected as a corrected instruction, a program counter buffer that holds an address of the instruction where an error has been detected, a selector that selects and outputs any of the output of the error correction circuit and the output of the instruction buffer, and a control unit that controls the read and write of the instruction specified by the address from and into the instruction memory. The control unit writes the corrected instruction in the instruction memory using an address held in the program counter buffer when a predetermined condition is satisfied after the occurrence of the error.

Abstract: An enterprise trust server (ETS) can include a user interface configured to initiate generation of a first file signature associated with a first file accessed from a file system associated with a computer system at a first time and generation of a second file signature associated with a second file accessed from the file system at a second time subsequent to the first time. The ETS also includes a file signature comparator configured to compare the first and second file signatures to determine a difference set of file signatures. The ETS can be configured to send a request comprising the difference set of file signatures to a trust repository and to receive a response that identifies a software product associated with the first and second files that changed between the first and second times based on the difference set of file signatures.

Abstract: The disclosed principles describe systems and methods for assessing the security posture of a target device, wherein the assessment is performed by a scanning computer in communication with the target device via a communication network. By employing a system or method in accordance with the disclosed principles, distinct advantages are achieved. Specifically, conducting such a remote scan allows for the scanner computer to perform a remote scan of the remote device without installing client software to the remote device. Thus, the disclosed principles reduce the need for internal IT resources to manage the deployment and updates of client software on the target device. Also, conducting a remote scan according to the disclosed principles allows for the remote scan to be performed even if the scanner computer and remote device run different operating systems.

Abstract: According to one aspect of the present disclosure a method and technique for allocating virtualization-based resources for resolving a problem report associated with a computing environment is disclosed. The method includes: receiving a problem report associated with a computing environment; determining a resource template from the problem report corresponding to the computing environment; determining whether a virtual machine is available from a virtualization-based resource pool based on the resource template; and responsive to determining that a virtual machine is available from the virtualization-based resource pool based on the resource template, utilizing the virtual machine for the problem report.

Abstract: A testing apparatus includes a scenario processing unit that executes a test scenario for operating the testing apparatus to imitate the operation of a base station, a communication unit capable of transmitting and receiving a message to and from a mobile communication terminal, a layer processing unit for processing a message for each layer, a log data storing unit for storing log data indicating transmission of messages between the layers, and a display controller for creating a transmission schedule based on the extracted data associated with system information and causing a display unit to display the transmission schedule. The transmission schedule is written in a tabular form in which a block type of the system information is displayed at a position to which a frame for transmitting the system information is allocated.

Abstract: A computer-implemented method to facilitate administration of a network of members. Members of a network are provided with access to a shared message stream such that the members of the network are able to monitor messages generated by other members of the network posted to the shared message stream, wherein at least some of the messages are indicative of operational conditions of particular other members which generated the messages. Responsive to a first member of the network identifying a specific operational condition of the first member, the shared message stream is monitored for a message related to the specific operational condition. Provided the shared message stream includes a message related to the specific operational condition identified by the first member, an association of the message with an indication that the first member identifies with the specific operational condition is established, wherein the first member is configured to establish the association.

Abstract: A network monitoring system that summarizes a plurality of data packets of a session into a compact session record for storage and processing. Each session record may be produced in real-time and made available during the session and/or after the termination of the session. Depending on protocols, a network monitoring system extracts different sets of information, removes redundant information from the plurality of data packets, and adds performance information to produce the session record. The network monitoring system may retrieve and process a single session record or multiple session records for the same or different protocols to determine cause of events, resolve issues in a network or evaluate network performance or conditions. The session record enables analysis in the units of session instead of individual packets. Hence, the network monitoring system can analyze events, issues or performance of the network more efficiently and effectively.

Abstract: A method comprising managing persistent messaging data in a volatile memory of a primary instance of a multi-node server, wherein the persistent messaging data is stored in a Hard Disk Device (HDD) and a Fast Persistent Memory (FPM) of the primary instance, repeatedly replicating the persistent messaging data to a corresponding HDD and a corresponding FPM of at least one standby instance of the multi-node server, repeatedly copying the persistent messaging data stored in the FPM or the HDD of the at least one standby instance to a Recovery Memory Region (RMR) in a volatile memory of the at least one standby instance, and responsive to a failure of the primary instance, initiating a failover procedure by the standby instance, wherein the failover procedure comprises reading at least some of the persistent messaging data from the RMR in lieu of the HDD of the at least one standby instance.

Abstract: A system facilitates reporting product status information using a visual code. The system includes a code generator and a communication device. The code generator reports a product status with aggregate information in a visual code. In order to achieve this functionality, the code generator recognizes a status event trigger for a product. The code generator also compiles the aggregate information in response to the status event trigger for the product. The aggregate information includes product status information and product identification information. The code generator also generates the visual code representative of the aggregate information. The communication device facilitates communication of the visual code to a user.

Abstract: A power utilization scheduling system and methods are disclosed. A prioritized energy consumption schedule is determined based on a prioritized energy consumption. A per-process energy consumption model is determined based on an energy consumption model, and an operation is scheduled based on the prioritized energy consumption schedule and the per-process energy consumption model.

Abstract: Data storage systems and methods for storing data are described herein. The storage system includes at least two data storage nodes for storing portions of a distributed hash table and related data. After a first node attempts to complete a write request at a second node and is unable to complete the request, the first node ceases responses to interactions from other nodes. Once the first node's failure to respond has caused a sufficient number of nodes to cease responding, the nodes enter a service mode to resolve the live lock. While in live lock, the nodes determine the oldest, unfulfilled request using a system-wide logical timestamp associated with write requests. Once the oldest request is determined, a removal vote to remove the non-responsive node from the group is initiated and, if other nodes agree, the non-responsive node is removed from the group of nodes.

Abstract: A method for creating diagnostic files that includes receiving an error notification indicating that an error has occurred in a particular system section of a system that has a plurality of system sections. The error notification includes information about the error. A diagnostic file that includes a summarized error report of the particular system section is created based on the information included in the error notification. The diagnostic file is saved.

Abstract: Systems and methods for functionally verifying the performance of a system on a chip (SOC) are provided herein. According to some embodiments, the methods may include at least the steps of analyzing a verification log, via a functional verification system, to determine signatures by correlating a pattern of at least one of triggered and untriggered assertions in one or more blocks of a plurality of blocks to behaviors of at least one of the SOC and the one or more blocks of the plurality of blocks. Exemplary methods also include categorizing signatures according to the behaviors, and storing similar signatures based upon the categorization in a database.

Abstract: A monitoring system is configured to perform a cause analysis of an event which occurs in any of a plurality of node apparatuses. The monitoring system is configured to store a plurality of rules indicating a correspondence relationship between one or more condition events regarding any of the plurality of node apparatuses, and a conclusion. The monitoring system is configured to specify the first conclusion associated with the detected condition event based on the rule, and perform a detection possibility judgment on whether the monitoring system can detect the condition event or not, for each of one or more condition events out of a plurality of condition events, and calculate the first index value indicating the certainty of the first conclusion being the cause, based on the existence of detection of one or more condition events associated with the first conclusion and the result of the detection possibility judgment.

Abstract: An apparatus and a method are disclosed for controlling energy consumption in a marine vessel having a plurality of energy consuming users and fuel consuming engines. An exemplary apparatus includes a voyage management tool for planning a route for the marine vessel and for estimating energy consumption on the route; an energy management tool for predicting energy consumption; and control tool for managing an energy balance on the route.

Abstract: Methods and apparatus for debuggers supporting method restart are described. A method comprises implementing a user interface (UI) enabling a user to submit a request, via a single interaction within a debugging session, to restart execution of an invocable operation of a program. The method further comprises, in response to a request to restart an invocable operation, designating, as the source code line whose corresponding executable code is to be executed next, the first line of source code of the particular invocable operation that corresponds to an executable operation. The method includes indicating that execution of the program is to be resumed at the first line, and resuming execution of the program at the first line.

Abstract: Techniques are disclosed that include a computer-implemented method including transmitting a message in response to a predetermined event through a process stage including at least first and second processes being executed as one or more tasks, the message instructing the abortion of the executing of the one or more tasks, and initiating abortion of execution of the one or more tasks by the one or more of the processes on receiving the messages.

Abstract: Embodiments of methods, systems, and storage medium associated with providing diagnostic information are disclosed herein. In one instance, the method may include applying a pattern to a log line included in a log file accessible by the computing device, to determine whether there is a match between the log line and the pattern. The pattern may be one of a plurality of patterns included in a collection of previously accumulated diagnostic information including one or more relationship descriptions between the pattern and other ones of the plurality of patterns. The method may further include generating and storing one or more additional relationship descriptions in response to determination of a match for the pattern. The additional relationship descriptions may indicate connections between the matched pattern and at least some other patterns included in the diagnostic information. Other embodiments may be described and/or claimed.

Abstract: A trace generation device including a directed graph generator configured to generate a directed graph in accordance with execution of compiled traces whose maximum length is limited to a certain length or shorter and that have been generated at a low optimization level, the directed graph representing transitions of execution between the compiled traces; a directed graph updater configured to traverse edges in the directed graph backward from a start point in timer-based sampling, the start point being a node corresponding to a trace in which a timer tick has occurred, and configured to increment a recompilation counter of a trace that the backward traversal has reached when stopping in front of a cyclic trace or at a trace not having any further edge; and a generator configured to determine the head of a corresponding trace as a head of a new trace.

Abstract: Anti-tamper techniques for protecting a program code portion against tampering provide for defining a sequence of code segments having a root-code segment and a plurality of sub-code segment. Each sub-code segment is provided with an integrity checking portion for checking the integrity of a target code segment. At runtime, the integrity checking portion of a given sub-code segment carries out a checking procedure on the respective target code segment to obtain a runtime result which is compared with a reference result to verify that the target portion of the program has not been tampered with.

Abstract: A remaining time to replace can be updated taking into account time variation of a failure mechanism of a device. Starting with an initial remaining time to replace, an effective operating time can be determined periodically based on an operating parameter measured at a tracking interval, and remaining time to replace can be updated by subtracting the effective operating time. The technique can be applied to multiple failure mechanisms and to multiple devices and/or components each having multiple failure mechanisms.

Abstract: A cluster monitor (10) controls activation of a business application program and a monitoring agent in a cluster system (300) that includes a plurality of servers. The cluster monitor (10) includes a business server identifying unit (21) that identifies a server on which the business application program is operating among the servers, and an agent server selecting unit (22) that selects a server for activating the monitoring agent from among the servers based on the identified server.

Abstract: A failure detecting apparatus includes: a processor that executes a process includes: identifying, when a new message is output from a target to be monitored, a message to be replaced, which is output from the target to be monitored before the output of the new message and is not output from the target to be monitored after the output of the new message; extracting a pattern including the message to be replaced, from patterns of messages stored in a storage unit, the patterns indicating occurrences of failures, and registering, in the storage unit, a pattern resulting from substitution of the message to be replaced included in the extracted pattern with the new message; and detecting whether or not messages output from the target to be monitored include any of the patterns stored in the storage unit.

Abstract: A method for monitoring information systems has been provided. The method includes analyzing at least one event data record of an information technology system to determine whether at least one target system of the information technology system has monitoring levels, trace levels, log levels, or snap shot levels which should be changed. The method further includes based on the analyzed instructing the at least one target system to change their monitoring levels, trace levels, log levels, or snap shot levels. The method further includes analyzing said monitoring levels, trace levels, log levels, or snap shot levels of the at least one target system to determine a cause of the at least one event data record.

Abstract: Examples disclose a method to collect a first property and a second property of a computing device. The first property and the second property monitor a functionality of the computing device and are collected as a function of time. Further, the examples provide comparing the first property and the second property to identify a change indicating a degradation within the computing device.