Abstract: Computer-implemented methods and systems described herein perform intelligent sampling of application traces generated by an application. Computer-implemented methods and systems determine different sampling rates based on frequency of occurrence of trace types and/or frequency of occurrence of durations of the traces. Each sampling rate corresponds to a different trace type and/or different duration. The sampling rates for low frequency trace types and durations are larger than the sampling rates for high frequency trace types and durations. The relatively larger sampling rates for low frequency trace types and low frequency durations ensures that low frequency trace types and low frequency durations are sampled in sufficient numbers and are not passed over during sampling of the application traces. The set of sampled traces are stored in a data storage device.

Abstract: The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems.

Abstract: The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems.

Abstract: In a computer-implemented method for handling of an index update, time series data is received at an ingestion node of a time series data monitoring system. An index update is determined based on the time series data. The index update is stored to an index database of the time series data monitoring system. The index update is forward to a plurality of query nodes of the time series data monitoring system.

Abstract: In a computer-implemented method for querying a variably partitioned time series database, a query of a time series database is received, the query including a time range and a predicate comprising at least one dimension, wherein the time series database comprises a plurality of time series database schemas. At least one time series database schema of the time series database corresponding to the time range is determined. The query is divided into a plurality of sub-queries, wherein each sub-query of the plurality of sub-queries corresponds to one time series database schema of the plurality of time series database schemas. The plurality of sub-queries is executed to return a plurality of results.

Abstract: In a computer-implemented method for operating on a time series database including a plurality of time series database schemas, a query of a time series database is received, wherein the time series database includes a plurality of time series database schemas, and wherein each received data point is stored according to each time series database schema of the plurality of time series database schemas, such that the time series database comprises multiple instances of each data point. A query plan is generated according to the query and the plurality of time series database schemas corresponding to a time range.

Abstract: In a computer-implemented method for maintaining a time series database including a plurality of time series database schemas, time series data including data points are received at an ingestion node of a time series database, the data points comprising a plurality of dimensions. A plurality of time series database schemas of the time series database is determined for storing the time series data. The time series data is ingested according to the plurality of time series database schemas, wherein each data point is stored according to each time series database schema of the plurality of time series database schemas, such that the time series database comprises multiple instances of each data point.

Abstract: In a computer-implemented method for adapting time series database schema of a time series database, time series data ingested into a time series database according to a time series database schema is accessed over a time period, wherein time series data comprises a plurality of dimensions. The time series data of the time period is analyzed to determine a data shape of the time series data of the time period. It is determined whether to adapt the time series database schema based at least in part on the data shape of the time series data of the time period. In some embodiments, the time series database schema is adapted based at least in part on the data shape of the time series data of the time period. Time series data is then ingested into the time series database according to the adapted time series database schema.

Abstract: Computer-implemented methods and systems described herein perform intelligent sampling of application traces generated by an application. Computer-implemented methods and systems determine different sampling rates based on frequency of occurrence of normal traces and erroneous traces of the application. The sampling rates for low frequency normal and erroneous traces are larger than the sampling rates for high frequency normal and erroneous traces. The relatively larger sampling rates for low frequency trace ensures that low frequency traces are sampled in sufficient numbers and are not passed over during sampling of the application traces. The sampled normal and erroneous traces are stored in a data storage device.

Abstract: Computer-implemented methods and systems described herein perform intelligent sampling of application traces generated by an application. Computer-implemented methods and systems determine different sampling rates based on frequency of occurrence of trace types and/or frequency of occurrence of durations of the traces. Each sampling rate corresponds to a different trace type and/or different duration. The sampling rates for low frequency trace types and durations are larger than the sampling rates for high frequency trace types and durations. The relatively larger sampling rates for low frequency trace types and low frequency durations ensures that low frequency trace types and low frequency durations are sampled in sufficient numbers and are not passed over during sampling of the application traces. The set of sampled traces are stored in a data storage device.

Abstract: The current document is directed to methods and systems that employ distributed-computer-system metrics collected by one or more distributed-computer-system metrics-collection services, call traces collected by one or more call-trace services, and attribute values for distributed-computer-system components to identify attribute dimensions related to anomalous behavior of distributed-computer-system components. In a described implementation, nodes correspond to particular types of system components and node instances are individual components of the component type corresponding to a node. Node instances are associated with attribute values and node are associated with attribute-value spaces defined by attribute dimensions. A set of call traces is partitioned, by clustering.

Abstract: In a computer-implemented method for adapting time series database schema, a plurality of queries to a time series database received over a time period is accessed, wherein time series data is ingested into the time series database according to a time series database schema, wherein time series data comprises a plurality of dimensions. The plurality of queries of the time period is analyzed to determine a relative frequency of the plurality of dimensions within the plurality of queries over the time period. It is determined whether to adapt the time series database schema based at least in part on the relative frequency of the plurality of dimensions within the plurality of queries over the time period.

Abstract: The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems.

Abstract: The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems.

Abstract: The current document is directed to methods and systems that employ distributed-computer-system metrics collected by one or more distributed-computer-system metrics-collection services, call traces collected by one or more call-trace services, and attribute values for distributed-computer-system components to identify attribute dimensions related to anomalous behavior of distributed-computer-system components. In a described implementation, nodes correspond to particular types of system components and node instances are individual components of the component type corresponding to a node. Node instances are associated with attribute values and node are associated with attribute-value spaces defined by attribute dimensions. A set of call traces is partitioned, by clustering.

Abstract: The current document is directed to methods and systems that generate forecasts based on input time-series data using a forecasting neural network or other machine-learning-based forecasting subsystem. In various implementations, an input time series is first classified and then transformed, based on the classification, to a corresponding stationary time series. The corresponding stationary time series is then submitted to a neural network or other machine-learning-based forecasting subsystem to generate an initial forecast for future time points. The initial forecast is then inverse transformed, based on the input-time-series classification, to generate a final, output forecast.

Abstract: The current document is directed to methods and systems that generate forecasts based on input time-series data using a forecasting neural network or other machine-learning-based forecasting subsystem. In various implementations, an input time series is first classified and then transformed, based on the classification, to a corresponding stationary time series. The corresponding stationary time series is then submitted to a neural network or other machine-learning-based forecasting subsystem to generate an initial forecast for future time points. The initial forecast is then inverse transformed, based on the input-time-series classification, to generate a final, output forecast.

Abstract: The current document is directed to improved system monitoring and management tools and methods based on generation an anomaly signal from time-series data collected from components of a computer system, providing improved system monitoring and management. The time series data comprises a time-ordered sequence of metric datapoints that is received over a period of time. At each of a set of discrete, successive time points within the period of time, a datapoint for the anomaly signal is generated from a forecast generated from a preceding set of time-series datapoints, referred to as a “history window,” and a short segment of the time series, referred to as the “observation window,” extending forward in time from the most recently datapoint in the history window. The anomaly signal predicts incipient anomalous conditions in the computer system.

Abstract: In a computer-implemented method for proactive handling of an index update, a data point is received at an ingestion node of a time series data monitoring system. It is determined whether an update to a local index of the ingestion node is necessitated based on the data point and the local index. Provided the update to the local index is necessitated, an index entry corresponding to the data point in the local index is updated based on the data point. The index entry corresponding to the data point is marked with a volatile indicator, the volatile indicator indicating that receipt of an index update to a corresponding index entry at a durable index of the time series data monitoring system is unconfirmed. The index update to the durable index corresponding to the data point is initiated.

Abstract: In a method for secure access to metrics of time series data, an access request for accessing at least one metric of time series data is received, the access request including an identifier. The access request is validated against a security policy according to the identifier. The access request is updated to exclude any metric indicated in the security policy as excluded according to the identifier. Results of the access request are returned.