Abstract: A method for detecting identity theft or identity change in managed computing systems is disclosed. An apparatus and computer program product also perform the functions of the method. The method includes identifying that a unique identifier of a first computing device assigned a first IP address matches a unique identifier of a second computing device assigned a second IP address and, in response to identifying that the unique identifier of the first computing device matches the unique identifier of the second computing device, sending a test message to the first computing device using the first IP address. The method includes sending an alert of a possible malicious event in response to receiving a response to the test message and sending an alert of a possible misconfiguration in response to a failure to receive a response to the test message.

Abstract: A method includes establishing a WebSocket connection between an on-premises WebSocket application hosted on a first on-premises compute node and an off-premises WebSocket application hosted on a first off-premises compute node, wherein the first on-premises compute node is in an on-premises network having a firewall that prevents the first off-premises compute node from initiating a connection with the first on-premises compute node, and wherein the on-premises WebSocket application hosted on the first on-premises compute node initiates the establishing of the WebSocket connection with the off-premises WebSocket application hosted on the first off-premises compute node. The method further includes sending a message from a client application hosted on a second off-premises compute node to a server application hosted on a second on-premises compute node through the WebSocket connection, wherein the second off-premises compute node initiates the sending of the message to the second on-premises compute node.

Abstract: A method may include various operations and a computer program product may cause a processor to perform various operations. The operations include receiving a task to be performed by a software application including numerous processing services, assigning a task identifier to the task before any processing service processes the task, and storing, for each processing service that processes the task, the task identifier in a record that associates the processing service identity with the task identifier in response to the processing service obtaining the task. Optional operations may further include detecting that the task has experienced a service event, identifying each of the processing services that processed the task prior to the service event, and collecting a service data log from each of the identified processing services. A service data archive may be formed with the service data logs collected from each of the identified processing services.

Abstract: A method for creation of a secured connection for an inoperable virtual machine includes receiving a token at an on-host service running on an inoperable virtual machine (“VM”) on a server. The token is generated by a remote service person. The method includes receiving a user generated password from a user having direct access to the on-host service. The method includes creating a secured connection, using the token and password, between the on-host service and a remote server of the service person. The method includes transmitting a VM identifier of the inoperable VM to the user and receiving communications from the remote server. The communications include commands for the inoperable VM. The service person accesses the on-host service and inoperable VM using the VM identifier and the password. The password and VM identifier are transmitted to the service person by the user via a channel separate from the secured connection.

Abstract: Apparatuses, methods, systems, and program products are disclosed for analytics-based anomaly detection. An apparatus includes a processor and a memory that stores code executable by the processor. The code is executable by the processor to receive measurement data for a component of a device, determine a compression rate of the received measurement data by applying a compression algorithm to the measurement data, and generate an alert indicating a possible anomaly in an operation of the component represented by the measurement data in response to the determined compression rate satisfying a threshold compression rate for the at least one condition of the component.

Abstract: A method includes identifying maximum and minimum values in an input data set after a request to display data from the data set, which is remote and includes many entries with a first and a second value. First values are ordered sequentially and maximum and minimum values are second values. The method subtracts the minimum value from the maximum value to find a height, determines a target data amount for downloading to display to satisfy interface quality experience criteria, and calculates a difference level for a compression algorithm. The compression algorithm uses the difference level to select input data set entries for a compressed data set and is based on the input data set, the target data amount and the height. The method includes processing the input data set with the compression algorithm and the difference level to create the compressed data set, and transmitting the compressed data set.

Abstract: Apparatuses, methods, systems, and program products are disclosed for analytics-based anomaly detection. An apparatus includes a processor and a memory that stores code executable by the processor. The code is executable by the processor to receive measurement data for a component of a device, determine a compression rate of the received measurement data by applying a compression algorithm to the measurement data, and generate an alert indicating a possible anomaly in an operation of the component represented by the measurement data in response to the determined compression rate satisfying a threshold compression rate for the at least one condition of the component.

Abstract: A method for installing and using hardware specific plugins to a monitoring application includes installing, by use of a processor, a hardware specific plugin to a monitoring application that monitors health of a monitored computing system. The plugin corresponds to a hardware device of the monitored computing system monitored by the monitoring application. The plugin includes analytics rules corresponding to hardware parameters monitored within the hardware device and received by a server comprising the processor and running the monitoring application. The method includes receiving, by use of a processor, data corresponding to the hardware parameters of the hardware device, applying, by use of a processor, the analytics rules of the plugin to the received data of the monitored hardware parameters of the hardware device, and sending, by use of a processor, an alert in response to determining that the received data violates an analytics rule of the plugin.

Abstract: An apparatus and a computer program product include a non-volatile computer readable medium and non-transitory program instructions embodied therein, the program instructions being configured to be executable by a processor to cause the processor to perform operations. The operations may include running a web server on a virtual machine that is running software application and an operating system that supports the software application, causing the operating system to obtain and provide service data for the software application after failure of the software application, causing the web server to receive the service data from the operating system, and causing the web server to send the obtained service data to an entity that is outside the virtual machine.

Abstract: A method for installing and using hardware specific plugins to a monitoring application includes installing, by use of a processor, a hardware specific plugin to a monitoring application that monitors health of a monitored computing system. The plugin corresponds to a hardware device of the monitored computing system monitored by the monitoring application. The plugin includes analytics rules corresponding to hardware parameters monitored within the hardware device and received by a server comprising the processor and running the monitoring application. The method includes receiving, by use of a processor, data corresponding to the hardware parameters of the hardware device, applying, by use of a processor, the analytics rules of the plugin to the received data of the monitored hardware parameters of the hardware device, and sending, by use of a processor, an alert in response to determining that the received data violates an analytics rule of the plugin.

Abstract: An apparatus and a computer program product include a non-volatile computer readable medium and non-transitory program instructions embodied therein, the program instructions being configured to be executable by a processor to cause the processor to perform operations. The operations may include running a web server on a virtual machine that is running software application and an operating system that supports the software application, causing the operating system to obtain and provide service data for the software application after failure of the software application, causing the web server to receive the service data from the operating system, and causing the web server to send the obtained service data to an entity that is outside the virtual machine.