Abstract: A method, computer system, and a computer program product are provided for dynamic viewing of an operation graph depicting a distributed workload in an Information Technology system. A list may be received as input and may include selected nodes. A sub-graph may be abstracted from a global graph. The sub-graph and the global graph may depict interactions among ops objects of the distributed workload using nodes and edges. First nodes may be removed from the global graph according to the list. Direct edges between remaining nodes from the global graph may be maintained. A first indirect edge may be generated based on the removed first nodes. The first indirect edge may run between a first remaining node and a second remaining node. The sub-graph may be presented removed from the global graph.

Abstract: Disclosed embodiments provide techniques for dynamic data collection. The dynamic data collection includes determining a data generation temporal pattern. Based on the data generation temporal pattern, a data collection strategy is created. The data collection strategy can be based on one or more data collection goals. The data collection strategy can contain specific details on how data is to be collected. A data infrastructure evaluation is performed, which provides pricing models for resources such as electricity and/or network bandwidth. A data collection policy is created based on the data collection strategy and the data infrastructure evaluation. The data collection policy can contain specific details on when data is to be collected and what strategy to use for the collection. A data transfer schedule is created based on the data collection policy. The data transfer schedule determines when to collect data from one or more data source devices.

Abstract: Computer implemented method, systems, and computer program products include program code executing on a processor(s) monitors objects in the technical environment to collect real-time operational data. The program code obtains historical operational data and historical resource data from the technical environment and generates models to evaluate health states and resource states of the one or more objects. The program code applies the models and identifies objects as abnormal. The program code obtains a topology of the technical environment to identify objects impacted by the abnormal object(s). The program code generates a resource aware dynamic operational data collection plan.

Abstract: A computer implemented method manages a topology for a network computing system. A number of processor units determines tasks for a workload to be performed by computing devices in the network computing system. The number of processor units creates the topology for performing the tasks in the workload. The topology comprises nodes representing the tasks assigned to the computing devices. The nodes are connected to each other based on an execution order for the tasks, and the topology has alternative paths for performing the tasks for the workload. The number of processor units determines energy consumption for the alternative paths in the topology. The number of processor units selects a particular path from the alternative paths for performing the tasks for the workload based on the energy consumption for the alternative paths.

Abstract: A system may include a memory and a processor in communication with the memory. The processor may be configured to perform operations. The operations may include receiving a task request from a user and determining a preferred executor type for the task request. The operations may include selecting an executor of the preferred executor type for the task request. The operations may include performing the task request with the executor and returning a response to the task request to the user.

Abstract: A method of managing an active-active database system storing a first copy of data records at a first node a second copy of the data records at a second node includes receiving a first set of operations stored at the first node as a first set of local operations, a copy of the first set of operations transmitted to the second node and stored as a first set of remote operations, and receiving a second set of operations stored at the second node as a second set of local operations, a copy of the second set of operations transmitted to the first node and stored as a second set of remote operations. The method includes determining a comparison point by selecting an operation from each of the first set of operations and the second set of operations, and comparing the first copy of the data records to the second copy.

Abstract: Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to integrate documentation knowledge with log mining data. A non-limiting example computer-implemented method includes determining a message-message relationship based on log message documentation and building a first subgraph based on the message-message relationship. The method further includes receiving a first message log entry having a message identifier and message field data. A second message log entry is correlated with the first message log entry based on at least one of the message identifier and the message field data. A second subgraph is built that includes the first message log entry and the second message log entry. The method includes building a graph that includes the first subgraph and the second subgraph.

Abstract: A method, computer system, and a computer program product for data compression is provided. The present invention may include receiving operational data. The present invention may include profiling the operational data using one or more normalizing functions. The present invention may include extracting a plurality of patterns from the operational data. The present invention may include compressing the operational data based on the plurality of patterns extracted.

Abstract: Embodiments of the invention are directed to annotating a log based on processing log documentation. Aspects include obtaining the data set and obtaining a set of templates, wherein one or more template of the set of templates includes a variable labeled as the data type. Aspects also include annotating the data set based on the set of templates, wherein the annotating includes labeling each value of the variable in the data set with the data type. Aspects further include creating an updated data set by replacing each value of the variable in the data set that is labeled with the data type with a new data value.

Abstract: A method, computer system, and a computer program product for application modernization is provided. The present invention may include receiving operation data related to an application. The present invention may include identifying a plurality of entities based on the operation data related to the application. The present invention may include identifying one or more interactions between each of the plurality of entities. The present invention may include determining an energy consumption pattern for the application by analyzing a consumption of energy related to workload. The present invention may include determining a modernization scope for the application based on the energy consumption pattern.

Abstract: Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to perform message correlation extraction for mainframe operation. A non-limiting example computer-implemented method includes receiving a first message log entry having a message identifier and message field data. The first message log entry is pre-processed to determine the message identifier and to tokenize the message field data. A second message log entry is identified based on at least one of the message identifier and the tokenized message field data. The method further includes determining that the second message log entry is correlated with the first message log entry and providing an output comprising the message correlation between the first message log entry and the second message log entry.

Abstract: Embodiments of the present invention relate to methods, systems, and computer program products for event management. In a method, a plurality of notes that are comprised in a plurality of event records are obtained in a computer system. A plurality of paragraphs that are comprised in the plurality of notes are classified into a plurality of content types based on a content analysis of the plurality of paragraphs. The plurality of notes are classified into a plurality of semantic types based on the plurality of content types and a syntactic parsing to the plurality of notes. A knowledge item is generated for managing an event in the computer system based on a group of notes in the plurality of notes that are classified into the plurality of semantic types. With these embodiments, knowledge items for managing events may be obtained in an easier and more effective way.

Abstract: Embodiments of the invention are directed to annotating a log based on processing log documentation. Aspects include obtaining the log having a plurality of entries. Aspects also include creating a set of log entry templates by processing the log documentation associated with the log, wherein each log entry template includes one or more constants and one or more variables. Aspects further include annotating each of the plurality of entries based on the set of templates, wherein the annotating includes labeling each value of the one or more variables with a variable name.

Abstract: Embodiments of the present invention relate to methods, systems, and computer program products for event management. In a method, a plurality of notes that are comprised in a plurality of event records are obtained in a computer system. A plurality of paragraphs that are comprised in the plurality of notes are classified into a plurality of content types based on a content analysis of the plurality of paragraphs. The plurality of notes are classified into a plurality of semantic types based on the plurality of content types and a syntactic parsing to the plurality of notes. A knowledge item is generated for managing an event in the computer system based on a group of notes in the plurality of notes that are classified into the plurality of semantic types. With these embodiments, knowledge items for managing events may be obtained in an easier and more effective way.

Abstract: A computer-implemented method, system, and non-transitory machine readable medium for a graph-based analysis for an Information Technology (IT) operations includes generating a temporal graph by extracting one or more of operation objects, relations and attributes from operation data of workloads distributed across a plurality of levels of the IT operation within a predetermined time window. Anomalies are detected from the extracted operation data and annotating corresponding objects in the graph. A directional impact between corresponding objects on the temporal graph is determined, and the temporal graph is refined based on the determined directional impact. Accessible paths in the temporal graph indicating error propagation are searched, and potential causes for the detected anomalies in the temporal graph are identified. A list of the potential causes of the anomalies is generated, and a root cause ranked for each of the corresponding objects in the temporal graph.

Abstract: Embodiments of the invention are directed to annotating a log based on processing log documentation. Aspects include obtaining the data set and obtaining a set of templates, wherein one or more template of the set of templates includes a variable labeled as the data type. Aspects also include annotating the data set based on the set of templates, wherein the annotating includes labeling each value of the variable in the data set with the data type. Aspects further include creating an updated data set by replacing each value of the variable in the data set that is labeled with the data type with a new data value.

Abstract: Embodiments of the invention are directed to annotating a log based on processing log documentation. Aspects include obtaining the log having a plurality of entries. Aspects also include creating a set of log entry templates by processing the log documentation associated with the log, wherein each log entry template includes one or more constants and one or more variables. Aspects further include annotating each of the plurality of entries based on the set of templates, wherein the annotating includes labeling each value of the one or more variables with a variable name.

Abstract: According to an aspect, a method includes searching for a correlated log identifier in a correlation database based on detecting a metrics-based anomaly. The method also includes providing, in a problem diagnosis, related log information associated with the correlated log identifier based on locating one or more log entries including the correlated log identifier in a same time window as the metrics-based anomaly. The method further includes searching for a correlated metric in the correlation database based on detecting a log-based anomaly and providing, in the problem diagnosis, related metric information associated with the correlated metric based on locating one or more metrics records including the correlated metric in the same time window as the log-based anomaly.

Abstract: A computer-implemented method is presented for automatically generating alerting rules. The method includes identifying, via offline analytics, abnormal patterns and normal patterns from history logs based on machine learning, statistical analysis and deep learning, the history logs stored in a history log database, automatically generating the alerting rules based on the identified abnormal and normal patterns, and transmitting the alerting rules to an alerting engine for evaluation. The method further includes receiving a plurality of online log messages from a plurality of computing devices connected to a network, augmenting the plurality of online log messages, and extracting information from the plurality of augmented online log messages to be provided to the alerting engine, the alerting engine configured to approve and enforce the alerting rules automatically generated by the offline analytics processing.

Abstract: Techniques include collecting current logs from distributed sources, selecting a group of the current logs that are from a related source of the distributed sources, and generating a feature vector using the group of the current logs. A current status model is created for the feature vector using the group of the current logs. One or more anomalies are determined in the group of the current logs based on a difference between the current status model and a reference status model, the reference status model being based on history logs.