Abstract: A disclosed example to determine a migration recommendation of a service between geographic regions includes: a graph generator to generate an interaction graph, the interaction graph including first and second nodes and an edge therebetween, the first node representative of a first service in a first geographic region, the second node representative of a second service in a second geographic region, and the edge representative of a network path of interactions between the first and second services; a weighing engine to determine a weight value of the edge between the first and second services based on a count of network interactions between the first and second services and a real-time latency between the first and second services; and a recommendation engine to generate a migration recommendation to migrate the first service to the second geographic region based on the weight value of the edge.

Abstract: The detection of utilized virtual machines through usage pattern analysis is described. In one example, a computing device can collect utilization metrics from a virtual machine over time. The utilization metrics can be related to one or more processing usage, disk usage, network usage, and memory usage metrics, among others. The utilization metrics can be used to determine a number of clusters, and the clusters can be used to organize the utilization metrics into groups. Depending upon the number or overall percentage of the utilization metrics assigned to individual ones of the plurality of clusters, it is possible to determine whether or not the virtual machine is a utilized or an idle virtual machine. Once identified, utilized virtual machines can be migrated in some cases. Idle virtual machines can be shut down to conserve processing resources and costs in some cases.

Abstract: In an example, a computer-implemented method may include receiving, during runtime, a plurality of logs of a network activity associated with compute nodes of a protected network. Further, the method may include extracting a vulnerability signature of an attack based on the plurality of logs. Furthermore, the method may include validating the vulnerability signature of the attack by correlating the vulnerability signature with available data on a first public database. Upon validating the vulnerability signature, the method may include retrieving vulnerability information associated with the vulnerability signature from the first public database or a second public database. Further, the method may include presenting the vulnerability information associated with the vulnerability signature on a graphical user interface.

Abstract: An example method may include displaying the plurality of log messages, including a first log message. Further, the method may include receiving an indication to extract a field based on a specified portion of log text of the first log message. Furthermore, the method may include inferring a first regular expression for the specified portion of the first log message using a Grok pattern. Further, the method may include inferring a second regular expression for a context of the extracted field using the Grok pattern. The context may be determined based on the specified portion. Further, the method may include generating a definition of the extracted field having the first regular expression and the second regular expression. Furthermore, the method may include filtering the plurality of log messages based on the definition of the extracted field.

Abstract: A system and method for generating a service topology graph for microservices in a computing environment uses traces collected from the microservices to generate the service topology graph. The traces are processed to create nodes and edges of the service topology graph. A new node is created when a current trace being processed is a trace being processed for a first time and an edge is created between a node that is associated with a parent span of a current span being processed when the current span is a first span being processed for the current trace and the current span includes a parent span identification.

Abstract: An example system includes memory, programmable circuitry, and machine readable instructions to program the programmable circuitry to: obtain utilization metric information corresponding to utilization metrics collected over a time interval, the utilization metrics corresponding to allocated resources utilized by containers, the containers associated with a cluster, obtain a request to generate priority classes for the containers in the cluster, the priority classes indicative of which containers have a greater priority in the cluster, and generate the priority classes for the containers based on the utilization metric information and a count of network interactions corresponding to the containers for the time interval.

Abstract: A system and method for managing logs from computing environments uses a rate change in a rate of occurrence of same event type logs from a base time window to a current time window for each of the event types to identify candidate event types for a particular tier log storage. The rate changes of the event types are checked against a threshold rate change range to identify the candidate event types. In response to selection of some of the candidate event types, the logs in the selected candidate event types are transferred to the particular tier log storage.

Abstract: Methods and systems described herein are directed to aggregating and querying log messages. Methods and systems determine event types of log message generated by event sources of the distributed computing system. The event types are aggregated into aggregated records for a shortest time unit and event types are aggregated into aggregated records for longer time units based on the aggregated records associated with the shortest time unit. In response to a query regarding occurrences of an event type in a query time interval, the query time interval is split into subintervals with time lengths that range from the shortest time unit to a longest time unit that lie within the query time interval. The method determines a total event count of occurrences of the event type in the query time interval based on the aggregated records with time stamps in the subintervals. The event count in the query time interval may be used to detect abnormal behavior of the event sources.

Abstract: Methods and systems described herein are directed to storing and querying log messages using log message bifurcation. Each log message that exceeds a time limit for storage in a live storage database is bifurcated into a log pattern that is stored in a log-pattern database and a metric object that records variable information of the log message in a time-series metric database. The log-pattern database and the time-series metric database together provide long-term log storage for the information contained in log messages that are too old to be stored in a live storage database. A request for access to log messages stored in the long-term log storage is completed by reconstructing the requested log messages from log patterns stored in the log-pattern database and metric objects stored in the time-series metric database.

Abstract: Agentless method to automatically detect low latency groups in containerized infrastructures includes obtaining information about communication across workloads within a cluster of containers implemented by an operating environment. The information identifies multiple pairs of containers. Each pair includes a network source container and a corresponding network destination container. The information includes, for each pair of containers, a corresponding latency associated with a network call between the network source container and the corresponding network destination container. An undirected graph is generated using the obtained information. The undirected graph represents a node-wide latency within the cluster. Using the undirected graph, nodes within the cluster with a latency less than a threshold latency level are grouped. Grouped nodes with latencies less than the threshold latency level are provided.

Abstract: An example system includes memory, programmable circuitry, and machine readable instructions to program the programmable circuitry to: obtain utilization metric information corresponding to utilization metrics collected over a time interval, the utilization metrics corresponding to allocated resources utilized by containers, the containers associated with a cluster, obtain a request to generate priority classes for the containers in the cluster, the priority classes indicative of which containers have a greater priority in the cluster, and generate the priority classes for the containers based on the utilization metric information and a count of network interactions corresponding to the containers for the time interval.

Abstract: Methods and systems predict parameters in a dataset of an identified piece of (“information technology”) IT equipment. An automated method identifies datasets IT equipment in a same category of IT equipment as a piece of IT equipment identified as having incomplete dataset information. Each dataset of IT equipment parameters is used to construct generalized linear models of different classes of IT equipment within the category of IT equipment. The class of the identified IT equipment is determined. A predicted equipment parameter of incomplete information of the identified piece of IT equipment is computed using the generalized linear model associated with the class. The predicted equipment parameter can be used to complete the dataset of the identified piece of IT equipment.

Abstract: Automated computer-implemented processes and systems described herein are directed to performing curation of log messages. The automated processes and systems filter unacceptable character strings from log messages to obtain curated text statements. The curated text statements contain human-readable text that enables a reader to understand the underlying messages contained in the log messages.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to detect drift in a hybrid cloud environment. An example apparatus to detect drift in a hybrid cloud environment includes a configuration model determiner to, after deployment of a blueprint in the hybrid cloud environment, generate a first model including first relationships of a first plurality of resources corresponding to the blueprint, the blueprint including a plurality of properties in which at least one of the plurality of properties is agnostic of type of cloud, an inventor model determiner to generate a second model including second relationships of a second plurality of resources as deployed in the hybrid cloud environment based on the blueprint, and a drift determiner to determine a drift value based on the first relationships and the second relationships, the drift value representative of a difference between the first relationships and the second relationships.

Abstract: An example apparatus includes memory, and at least one processor to execute instructions to assign first containers to a first cluster and second containers to a second cluster based on the first containers including first allocated resources that satisfy a first threshold number of allocated resources and the second containers including second allocated resources that satisfy a second threshold number of allocated resources, determine a representative interaction count value for a first one of the first containers, the representative interaction count value based on a first network interaction metric corresponding to an interaction between the first one of the first containers and a combination of at least one of the first containers and at least one of the second containers, and generate a priority class for the first one of the first containers based on the representative interaction count value.

Abstract: Disclosed are various embodiments for automating the prediction of workload tenures in datacenter environments. In some embodiments, parameters are identified for a plurality of workloads of a software defined data center. A machine learning model is trained to determine a predicted tenure based on parameters of the workloads. A workload for the software defined data center is configured to include at least one workload parameter. The workload is processed using the trained machine learning model to determine the predicted tenure. An input to the machine learning model includes the at least one workload parameter.

Abstract: Examples described herein include systems and methods for optimizing the number of servers in a cluster. In one example, a number of application servers, a number of backend servers, and a first disk throughput of a backend server to be included in the cluster are determined. The first disk throughput is determined based on the storage capacity of the backend server and a first round trip time. Example systems and method can also include validating the number of application servers based on a cluster throughput and one of a network interface card bandwidth of an application server to be included in the cluster and a load bearing capacity of the application server. The systems and methods can further include determining a second disk throughput of the backend server and increasing the number of backend servers if the second disk throughput is less than the second disk throughput.

Abstract: Agentless method to automatically detect low latency groups in containerized infrastructures includes obtaining information about communication across workloads within a cluster of containers implemented by an operating environment. The information identifies multiple pairs of containers. Each pair includes a network source container and a corresponding network destination container. The information includes, for each pair of containers, a corresponding latency associated with a network call between the network source container and the corresponding network destination container. An undirected graph is generated using the obtained information. The undirected graph represents a node-wide latency within the cluster. Using the undirected graph, nodes within the cluster with a latency less than a threshold latency level are grouped.

Abstract: A disclosed example to determine a migration recommendation of a service between geographic regions includes: a graph generator to generate an interaction graph, the interaction graph including first and second nodes and an edge therebetween, the first node representative of a first service in a first geographic region, the second node representative of a second service in a second geographic region, and the edge representative of a network path of interactions between the first and second services; a weighing engine to determine a weight value of the edge between the first and second services based on a count of network interactions between the first and second services and a real-time latency between the first and second services; and a recommendation engine to generate a migration recommendation to migrate the first service to the second geographic region based on the weight value of the edge.

Abstract: A system can provide a visual representation of an inventory of data entities for a distributed computing system. Inventory data including cost and operational data for data entities such as data centers, servers, and virtual machines, can be converted into a format file. The format file can be used to create a tree of nodes and node summaries corresponding to the data entities. A user interface can display hierarchical and isolated views of the tree revealing parent child relationships between data entities within a computing system infrastructure. Node summaries including cost and utilization data can be displayed to reveal how specific sub-costs such as labor and licensing, are driven by data entities in one level of the infrastructure and pushed to respective parent or child data entities in other levels. Views of the tree can be used to determine areas of inefficiency or reduced value within the computing system.