Abstract: Methods and systems described herein are directed to storing and querying log messages using log message bifurcation. Each log message that exceeds a time limit for storage in a live storage database is bifurcated into a log pattern that is stored in a log-patter database and a metric object that records variable information of the log message in a time-series metric database. The log-pattern database and the time-series metric database: together provide long-term log storage for the information contained in log messages that are too old to be stored in a live storage database. A request for access to log messages stored in the long-term log storage is completed by reconstructing the requested log messages from log patterns stored in the log-pattern database and metric objects stored in the time-series metric database.

Abstract: Methods and systems described herein are directed to aggregating and querying log messages. Methods and systems determine event types of log message generated by event sources of the distributed computing system. The event types are aggregated into aggregated records for a shortest time unit and event types are aggregated into aggregated records for longer time units based on the aggregated records associated with the shortest time unit. In response to a query regarding occurrences of an event type in a query time interval, the query time interval is split into subintervals with time lengths that range from the shortest time unit to a longest time unit that lie within the query time interval. The method determines a total event count of occurrences of the event type in the query time interval based on the aggregated records with time stamps in the subintervals. The event count in the query time interval may be used to detect abnormal behavior of the event sources.

Abstract: The current document is directed to methods and systems that efficiently and accurately process log/event messages generated within distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system and/or a message-ingestion-and-processing system, including masking sensitive fields to prevent exposure of confidential and sensitive information contained in log/event messages. Rule-based identification and masking of sensitive fields in log/event messages is currently provided by certain automated log/event-message systems, but current approaches suffer numerous deficiencies.

Abstract: A disclosed example to determine a migration recommendation of a service between geographic regions includes: a graph generator to generate an interaction graph, the interaction graph including first and second nodes and an edge therebetween, the first node representative of a first service in a first geographic region, the second node representative of a second service in a second geographic region, and the edge representative of a network path of interactions between the first and second services; a weighing engine to determine a weight value of the edge between the first and second services based on a count of network interactions between the first and second services and a real-time latency between the first and second services; and a recommendation engine to generate a migration recommendation to migrate the first service to the second geographic region based on the weight value of the edge.

Abstract: Methods and systems described herein are directed to classifying log messages generated by event sources of a distributed computing systems. Methods and systems generate a Grok expression and determine log-message metadata for each log message generated by the event sources. For each log message, the log message is classified based on the corresponding Grok expression and log-message metadata. Classified log messages may be used to perform troubleshooting and root cause analysis of the event sources.

Abstract: The detection of utilized virtual machines through usage pattern analysis is described. In one example, a computing device can collect utilization metrics from a virtual machine over time. The utilization metrics can be related to one or more processing usage, disk usage, network usage, and memory usage metrics, among others. The utilization metrics can be used to determine a number of clusters, and the clusters can be used to organize the utilization metrics into groups. Depending upon the number or overall percentage of the utilization metrics assigned to individual ones of the plurality of clusters, it is possible to determine whether or not the virtual machine is a utilized or an idle virtual machine. Once identified, utilized virtual machines can be migrated in some cases. Idle virtual machines can be shut down to conserve processing resources and costs in some cases.

Abstract: Automated methods and systems for generating Grok expressions for extraction of metric data from any type of log message are described. Method and systems include construction of a directed graph from Grok patterns. A sample log message is selected from log messages that record metrics values of a desired metric. The directed graph is used to construct a Grok expression from the sample log message. The Grok expression is then used to parse log messages that are of the same type or format as the sample log message to extract the desired metric data from the log messages. The metric may in turn be used to troubleshoot problems anchor identifying potential root causes of problems in a data center or other type of distributed computing system.

Abstract: The detection of idle virtual machines through usage pattern analysis is described. In one example, a computing device can collect utilization metrics from a virtual machine over time. The utilization metrics can be related to one or more processing usage, disk usage, network usage, and memory usage metrics, among others. The utilization metrics can be separated into a set of training metrics and a set of validation metrics, and a number of clusters can be determined based on the set of training metrics. The clusters can be used to organize the set of validation metrics into groups. Depending upon the number or overall percentage of the utilization metrics assigned to individual ones of the plurality of clusters, it is possible to determine whether or not the virtual machine is an idle virtual machine. Once identified, idle virtual machines can be shut down to conserve processing resources and costs.

Abstract: The current document is directed to methods and systems that efficiently transmit and process log/event messages within and among distributed computer facilities. By digesting and condensing log/event messages at the message-collector level, the volume of data transmitted from message collectors to message-ingestion-and-processing systems is greatly reduced, which increases system efficiencies by decreasing network overheads and which provides sufficient additional computational bandwidth at the message-collector level to allow message collectors to offload many message-processing tasks from message-ingestion-and-processing system and other downstream processing systems.

Abstract: Examples described herein include systems and methods for optimizing the number of servers in a cluster. In one example, a number of application servers, a number of backend servers, and a first disk throughput of a backend server to be included in the cluster are determined. The first disk throughput is determined based on the storage capacity of the backend server and a first round trip time. Example systems and method can also include validating the number of application servers based on a cluster throughput and one of a network interface card bandwidth of an application server to be included in the cluster and a load bearing capacity of the application server. The systems and methods can further include determining a second disk throughput of the backend server and increasing the number of backend servers if the second disk throughput is less than the second disk throughput.

Abstract: An example apparatus includes memory, and at least one processor to execute instructions to assign first containers to a first cluster and second containers to a second cluster based on the first containers including first allocated resources that satisfy a first threshold number of allocated resources and the second containers including second allocated resources that satisfy a second threshold number of allocated resources, determine a representative interaction count value for a first one of the first containers, the representative interaction count value based on a first network interaction metric corresponding to an interaction between the first one of the first containers and a combination of at least one of the first containers and at least one of the second containers, and generate a priority class for the first one of the first containers based on the representative interaction count value.

Abstract: Various examples are disclosed for using clustering routines to extrapolate metrics to other computing resources in a cluster. One or more computing devices can classify computing resources, such as servers, based on various characteristics of the computing resources. For each class of computing resource, a clustering routine can be applied to generate clusters of the computing resources. A minimal number of metrics required to be obtained from an end user can be determined as a function of a number of the clusters. If one or more of the metrics are obtained from the end user, the metrics can be extrapolated to other computing resources in the same cluster.

Abstract: System and computer-implemented method for managing workloads in a computing environment use collected resource utilization metrics for a workload of a compute instance running in the computing environment that are superimposed to produce a unified time series of the resource utilization metrics for the workload. Undesired periodic patterns are then removed from the unified time series of the resource utilization metrics, which is used to identify the compute instance as a particular type of compute instances. Based on the identification, an action is recommended and implemented on the compute instance.

Abstract: Example methods and apparatus to determine container priorities in virtualized computing environments are disclosed herein. Examples include: a cluster controller to classify a first container into a cluster based on the first container having a number of distinct allocated resources within a threshold number of distinct allocated resources corresponding to a second container; a container ranking generator to: determine resource utilization rank values for a resource usage type of a number of distinct allocated resources, the resource utilization rank values indicative that the first container utilizes the resource usage type more than the second container; determine an aggregated resource utilization rank value for the first container based on aggregating ones of the resource utilization rank values corresponding to the first container; and a container priority controller to generate a priority class for the first container based on the aggregated resource utilization rank value.

Abstract: Examples described herein include systems and methods for optimizing the number of servers in a cluster. In one example, a number of application servers, a number of backend servers, and a first disk throughput of a backend server to be included in the cluster are determined. The first disk throughput is determined based on the storage capacity of the backend server and a first round trip time. Example systems and method can also include validating the number of application servers based on a cluster throughput and one of a network interface card bandwidth of an application server to be included in the cluster and a load bearing capacity of the application server. The systems and methods can further include determining a second disk throughput of the backend server and increasing the number of backend servers if the second disk throughput is less than the second disk throughput.

Abstract: Example methods and apparatus to determine container priorities in virtualized computing environments are disclosed herein. Examples include: a cluster controller to classify a first container into a cluster based on the first container having a number of distinct allocated resources within a threshold number of distinct allocated resources corresponding to a second container; a container ranking generator to: determine resource utilization rank values for a resource usage type of a number of distinct allocated resources, the resource utilization rank values indicative that the first container utilizes the resource usage type more than the second container; determine an aggregated resource utilization rank value for the first container based on aggregating ones of the resource utilization rank values corresponding to the first container; and a container priority controller to generate a priority class for the first container based on the aggregated resource utilization rank value.

Abstract: Various examples are disclosed for workload placement and workload balancing across a cluster of nodes. Workloads can be migrated between nodes to free sufficient CPU and memory resources to place a new workload onto a cluster. Workloads can also be migrated between pods to balance CPU and memory utilization of nodes in a cluster.

Abstract: A system can provide a visual representation of an inventory of data entities for a distributed computing system. Inventory data including cost and operational data for data entities such as data centers, servers, and virtual machines, can be converted into a format file. The format file can be used to create a tree of nodes and node summaries corresponding to the data entities. A user interface can display hierarchical and isolated views of the tree revealing parent child relationships between data entities within a computing system infrastructure. Node summaries including cost and utilization data can be displayed to reveal how specific sub-costs such as labor and licensing, are driven by data entities in one level of the infrastructure and pushed to respective parent or child data entities in other levels. Views of the tree can be used to determine areas of inefficiency or reduced value within the computing system.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to detect drift in a hybrid cloud environment. An example apparatus to detect drift in a hybrid cloud environment includes a configuration model determiner to, after deployment of a blueprint in the hybrid cloud environment, generate a first model including first relationships of a first plurality of resources corresponding to the blueprint, the blueprint including a plurality of properties in which at least one of the plurality of properties is agnostic of type of cloud, an inventor model determiner to generate a second model including second relationships of a second plurality of resources as deployed in the hybrid cloud environment based on the blueprint, and a drift determiner to determine a drift value based on the first relationships and the second relationships, the drift value representative of a difference between the first relationships and the second relationships.

Abstract: A disclosed example to determine a migration recommendation of a service between geographic regions includes: a graph generator to generate an interaction graph, the interaction graph including first and second nodes and an edge therebetween, the first node representative of a first service in a first geographic region, the second node representative of a second service in a second geographic region, and the edge representative of a network path of interactions between the first and second services; a weighing engine to determine a weight value of the edge between the first and second services based on a count of network interactions between the first and second services and a real-time latency between the first and second services; and a recommendation engine to generate a migration recommendation to migrate the first service to the second geographic region based on the weight value of the edge.