Abstract: An incident management system comprises a processor adapted for: receiving a plurality of logs each documenting at least one historical investigation instruction executed in the management system and each comprising a parameter range of the historical instruction and a presentation type of response data received in response to executing the historical instruction; and in each of a plurality of iterations: receiving from a GUI of the management system an incident report selected by a user from a plurality of incident reports presented therein; generating, based on the incident report and an analysis of the logs, a sequence of investigation instructions for generating part of the GUI depicting analysis data for cause-analysis of an incident documented by the incident report; and presenting the sequence of instructions in the GUI such that when the user selects one of the sequence of instructions, the selected instruction is executed by the processor.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: An incident management system comprises a processor adapted for: receiving a plurality of logs each documenting at least one historical investigation instruction executed in the management system and each comprising a parameter range of the historical instruction and a presentation type of response data received in response to executing the historical instruction; and in each of a plurality of iterations: receiving from a GUI of the management system an incident report selected by a user from a plurality of incident reports presented therein; generating, based on the incident report and an analysis of the logs, a sequence of investigation instructions for generating part of the GUI depicting analysis data for cause-analysis of an incident documented by the incident report; and presenting the sequence of instructions in the GUI such that when the user selects one of the sequence of instructions, the selected instruction is executed by the processor.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: A computer implemented method of creating a clustering model used for clustering a plurality of log messages comprising using one or more processors for receiving a plurality of training log messages, performing the following for each of the plurality of training log messages: calculating a string distance between a textual content of the respective training log message and a representative string pattern of each of the plurality of clusters, associating the respective training log message with a respective one of the plurality of clusters in case the string distance is within a predefined threshold and adding a new cluster to the plurality of clusters for associating respective training log message in case the string distance exceeds the predefined threshold, and outputting the clustering model.

Abstract: A system for managing a plurality of shared computer resources, comprising at least one hardware processor adapted for: in at least one of a plurality of management iterations: computing statistical values each associated with one of a plurality of streams, where the streams are input to a plurality of computing processes which are used for processing the plurality of streams, executed using at least one of a plurality of shared computer resources; identifying according to an analysis of the statistical values at least one obstructing stream; allocating at least one new shared computer resource; creating a plurality of new computing processes which execute using the at least one new shared computer resource; and instructing inputting the at least one obstructing stream to the plurality of new computing processes instead of to the plurality of computing processes while the plurality of streams are inputted to the plurality of computing processes.

Abstract: A system for managing a plurality of shared computer resources, comprising at least one hardware processor adapted for: in at least one of a plurality of management iterations: computing statistical values each associated with one of a plurality of streams, where the streams are input to a plurality of computing processes which are used for processing the plurality of streams, executed using at least one of a plurality of shared computer resources; identifying according to an analysis of the statistical values at least one obstructing stream; allocating at least one new shared computer resource; creating a plurality of new computing processes which execute using the at least one new shared computer resource; and instructing inputting the at least one obstructing stream to the plurality of new computing processes instead of to the plurality of computing processes while the plurality of streams are inputted to the plurality of computing processes.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.

Abstract: A system and methods for classification of events, the system including a memory, a network interface, and a processor configured to monitor system events via the network interface and store the system events as an event log in the memory, collect information about events from various web resources, extract, from the event log and the collected event information, labeling data including data about urgency of events and generate, based on the extracted labeling data, labeling data structures ascribing labels to respective events, extract, from the event log and the collected event information, event features data and generate, based on the extracted event features data, event features data structures ascribing features to respective events, and formulate decision rule structures for identification of urgent events based on the labeling data structures and the event features data structures.