Abstract: Computational methods and systems that proactively manage usage of computational resources of a distributed computing system are described. A sequence of metric data representing usage of a resource is detrended to obtain a sequence of non-trendy metric data. Stochastic process models, a pulse wave model and a seasonal model of the sequence of non-trendy metric data are computed. When a forecast request is received, a sequence of forecasted metric data is computed over a forecast interval based on the estimated trend and one of the pulse wave or seasonal model that matches the periodicity of the sequence of non-trendy metric data. Alternatively, the sequence of forecasted metric data is computed based on the estimated trend and the stochastic process model with a smallest accumulated residual error. Usage of the resource by virtual objects of the distributed computing system may be adjusted based on the sequence of forecasted metric data.

Abstract: Computational methods and systems that proactively manage usage of computational resources of a distributed computing system are described. A sequence of metric data representing usage of a resource is detrended to obtain a sequence of non-trendy metric data. Stochastic process models, a pulse wave model and a seasonal model of the sequence of non-trendy metric data are computed. When a forecast request is received, a sequence of forecasted metric data is computed over a forecast interval based on the estimated trend and one of the pulse wave or seasonal model that matches the periodicity of the sequence of non-trendy metric data. Alternatively, the sequence of forecasted metric data is computed based on the estimated trend and the stochastic process model with a smallest accumulated residual error. Usage of the resource by virtual objects of the distributed computing system may be adjusted based on the sequence of forecasted metric data.

Abstract: A device for managing health data provides a first housing portion including a data storage system that stores health data and a second housing portion including a data communications element. The data communications element provides data communications between the data storage system and a processing device that processes the health data according to a data-management software. The first housing portion and the second housing portion are connected by a cable that communicates signals between the data communications element and other components in the first housing portion. Another device for managing health data provides a first housing portion including a health data management system and a data communications element that provides data communications between the health data management system and an external processing device. The second housing portion is removably coupled to the first housing portion, and includes at least one component used by the health data management system.

Abstract: The current document is directed to methods and systems that collect metric data within computing facilities, including large data centers and cloud-computing facilities. In a described implementation, input metric data is compressed by replacing each metric data point with a one-bit, two-bit, four-bit, or eight-bit compressed data value. During a first time window following reception of a metric data point, the metric data point remains available in uncompressed form to facilitate data analysis and monitoring functionalities that use uncompressed metric data. During a second time window, the metric data point is compressed and stored in memory, where the compressed data point remains available for data analysis and monitoring functionalities that use compressed metric data for detection of peaks, periodic patterns, and other characteristics. Finally, the compressed data point is archived in mass storage, where it remains available to data-analysis and management functionalities for a lengthy time period.

Abstract: This disclosure is directed to tagging tokens or sequences of tokens in log messages generated by a logging source. Event types of log messages in a block of log messages are collected. A series of tagging operations are applied to each log message in the block. For each tagging operation, event types that are qualified to receive the corresponding tag are identified. When a log message is received, the event type is determined and compared with the event types of the block in order to identify a matching event type. The series of tagging operations are applied to the log message to generate a tagged log message with the restriction that each tagging operation only applies a tag to token or sequences of tokens when the event type is qualified to receive the tag. The tagged log message is stored in a data-storage device.

Abstract: The current document is directed to systems, and methods incorporated within the systems, that execute queries against log-file entries. A monitoring subsystem within a distributed computer system uses query results during analysis of log-file entries in order to detect changes in the state of the distributed computer system, identify problems or potential problems, and predict and forecast system characteristics. Because of the large numbers of log-file-entry containers that may need to be opened and processed in order to execute a single query, and because opening and reading through the entries in a log-file-entry container is a computationally expensive and time-consuming operation, the currently disclosed systems employ event-type metadata associated with log-file-entry containers to avoid opening and reading through the log-file entries of log-file-entry containers that do not contain log-file entries with event types relevant to the query.

Abstract: Methods and systems to narrow a search for potential sources of problems in a distributed computing system are described. A volatile event type of event messages recorded in an event-log file is identified. The volatile event type is an event type that may have unexpectedly increased in frequency over an observation time window. An historical period of time may be selected to search for potential sources of the volatile event type. Frequencies of event messages in the event-log file with the same event type as the volatile event type are determined for time intervals of the historical period of time. A time interval of the historical period of time with a largest increase in frequency of event messages is identified. A list of event messages of the event-log file in a selected sub-time interval of the sub-time intervals of the time interval are displayed in a graphical user interface.

Abstract: Methods and systems to identify and respond to low-priority event messages are described. Methods identify types of event messages recorded in event-log files as low-priority event messages. Methods enable an information technology (“IT”) administrator, or other user, to determine which low-priority event messages may be deleted, how the low-priority event messages may be sampled for storage, or how long the low-priority event messages may be stored in a data-storage device.

Abstract: Methods and systems that detect computer system anomalies based on log file sampling are described. Computers systems generate log files that record various types of operating system and software run events in event messages. For each computer system, a sample of event messages are collected in a first time interval and a sample of event messages are collected in a recent second time interval. Methods calculate a difference between the event messages collected in the first and second time intervals. When the difference is greater than a threshold, an alert is generated. The process of repeatedly collecting a sample of event messages in a recent time interval, calculating a difference between the event messages collected in the recent and previous time intervals, comparing the difference to the threshold, and generating an alert when the threshold is violated may be executed for each computer system of a cluster of computer systems.

Abstract: Methods and systems to identify log write instructions of a source code as potential sources of an event message of interest are described. Methods identify non-parametric tokens, such as text strings and natural language words and phrases, of an event message of interest. Candidate log write instructions and associated line numbers in a source code are identified. Non-parametric tokens of each event message of the one or more candidate log write instructions are determined. A confidence score is calculated for each candidate log write instruction based the number of non-parametric tokens the event message of interest and event message of the candidate log write instruction have in common. The candidate log write instructions are rank ordered based on the corresponding one or more confidence scores and the rank ordered candidate log write instructions and associated line numbers of the source code may be displayed in a graphical user interface.

Abstract: Methods and systems to narrow a search for potential sources of problems in a distributed computing system are described. A volatile event type of event messages recorded in an event-log file is identified. The volatile event type is an event type that may have unexpectedly increased in frequency over an observation time window. An historical period of time may be selected to search for potential sources of the volatile event type. Frequencies of event messages in the event-log file with the same event type as the volatile event type are determined for time intervals of the historical period of time. A time interval of the historical period of time with a largest increase in frequency of event messages is identified. A list of event messages of the event-log file in a selected sub-time interval of the sub-time intervals of the time interval are displayed in a graphical user interface.

Abstract: Methods and systems to identify and respond to low-priority event messages are described. Methods identify types of event messages recorded in event-log files as low-priority event messages. Methods enable an information technology (“IT”) administrator, or other user, to determine which low-priority event messages may be deleted, how the low-priority event messages may be sampled for storage, or how long the low-priority event messages may be stored in a data-storage device.

Abstract: Methods and systems to identify log write instructions of a source code as potential sources of an event message of interest are described. Methods identify non-parametric tokens, such as text strings and natural language words and phrases, of an event message of interest. Candidate log write instructions and associated line numbers in a source code are identified. Non-parametric tokens of each event message of the one or more candidate log write instructions are determined. A confidence score is calculated for each candidate log write instruction based the number of non-parametric tokens the event message of interest and event message of the candidate log write instruction have in common. The candidate log write instructions are rank ordered based on the corresponding one or more confidence scores and the rank ordered candidate log write instructions and associated line numbers of the source code may be displayed in a graphical user interface.

Abstract: A portable data-management system may be easily employed with multiple processing devices by eliminating the need to pre-install additional programs, agents, device drivers, or other software components on the hosts. A portable storage device contains software for a data-management application, which receives and processes test data from a meter that measures an analyte. The portable device may employ an interface protocol that makes the portable device immediately compatible with different operating systems and hardware configurations. Once the portable device is connected to the host, the data-management application can be automatically launched. The convenience and portability of a data-management system may be enhanced by integrating advanced data processing and display features with the portable device. The users may access some advanced presentations of health data without having to launch the data-management application on a separate host.

Abstract: The present disclosure is related to systems, methods, and non-transitory machine readable media for alerting with duplicate suppression. An example non-transitory machine readable medium can store instructions executable by a processing resource to cause a computing system to receive an alert at a first virtual computing instance (VCI) from a second VCI, compare the alert with at least one previously received alert to determine if the alert is a duplicate alert, and send the alert to an alert notification queue associated with the first VCI in response to a determination that the alert is not a duplicate alert. In some embodiments, the medium can store instructions to confirm that the alert has been sent in response to the determination that the alert is a duplicate alert.

Abstract: A portable data-management system may be easily employed with multiple processing devices by eliminating the need to pre-install additional programs, agents, device drivers, or other software components on the hosts. A portable storage device contains software for a data-management application, which receives and processes test data from a meter that measures an analyte. The portable device may employ an interface protocol that makes the portable device immediately compatible with different operating systems and hardware configurations. Once the portable device is connected to the host, the data-management application can be automatically launched. The convenience and portability of a data-management system may be enhanced by integrating advanced data processing and display features with the portable device. The users may access some advanced presentations of health data without having to launch the data-management application on a separate host.

Abstract: Methods and systems that detect computer system anomalies based on log file sampling are described. Computers systems generate log files that record various types of operating system and software run events in event messages. For each computer system, a sample of event messages are collected in a first time interval and a sample of event messages are collected in a recent second time interval. Methods calculate a difference between the event messages collected in the first and second time intervals. When the difference is greater than a threshold, an alert is generated. The process of repeatedly collecting a sample of event messages in a recent time interval, calculating a difference between the event messages collected in the recent and previous time intervals, comparing the difference to the threshold, and generating an alert when the threshold is violated may be executed for each computer system of a cluster of computer systems.

Abstract: A portable data-management system may be easily employed with multiple processing devices by eliminating the need to pre-install additional programs, agents, device drivers, or other software components on the hosts. A portable storage device contains software for a data-management application, which receives and processes test data from a meter that measures an analyte. The portable device may employ an interface protocol that makes the portable device immediately compatible with different operating systems and hardware configurations. Once the portable device is connected to the host, the data-management application can be automatically launched. The convenience and portability of a data-management system may be enhanced by integrating advanced data processing and display features with the portable device. The users may access some advanced presentations of health data without having to launch the data-management application on a separate host.

Abstract: The present disclosure is related to systems, methods, and non-transitory machine readable media for alerting with duplicate suppression. An example non-transitory machine readable medium can store instructions executable by a processing resource to cause a computing system to receive an alert at a first virtual computing instance (VCI) from a second VCI, compare the alert with at least one previously received alert to determine if the alert is a duplicate alert, and send the alert to an alert notification queue associated with the first VCI in response to a determination that the alert is not a duplicate alert. In some embodiments, the medium can store instructions to confirm that the alert has been sent in response to the determination that the alert is a duplicate alert.

Abstract: The current document is directed to methods and systems that process, classify, efficiently store, and display large volumes of event messages generated in modern computing systems. In a disclosed implementation, received event messages are assigned to event-message clusters based on non-parameter tokens identified within the event messages. A parsing function is generated for each cluster that is used to extract data from incoming event messages and to prepare event records from event messages that more efficiently and accessible store event information. The parsing functions also provide an alternative basis for assignment of event messages to clusters. Event types associated with the clusters are used for gathering information from various information sources with which to automatically annotate event messages displayed to system administrators, maintenance personnel, and other users of event messages.