Abstract: In examples, a system adaptively orders a set of regular expressions based on frequencies that respective regular expressions of the set of regular expressions match a set of messages, the adaptive ordering to produce an adaptively ordered set of regular expressions. The system determines, for a first message of the set of messages, whether a plurality of regular expressions of the adaptively ordered set of regular expressions match the first message. The system constructs a bi-directional graph representing the plurality of regular expressions that match the first message, and classifies a second message based on the adaptively ordered set of regular expressions and the bi-directional graph.

Abstract: A plurality of log messages may be clustered into a plurality of clusters. For each of the plurality of log messages, the log message may be partitioned into a series of substrings. At least two of the plurality of clusters may be selected. For each one of the at least two selected clusters, a parsing rule may be generated corresponding to a plurality of substrings each of which are at a given location of a respective one of the log messages of the plurality of log messages in the one of the selected cluster.

Abstract: In some examples, time-series datasets received from a system may be temporally aligned. In some examples, one of the time-series datasets may be deduplicated. In some examples, whether an anomaly has occurred in the system may be determined based on a non-deduplicated time-series dataset of the time-series datasets.

Abstract: In examples, a system adaptively orders a set of regular expressions based on frequencies that respective regular expressions of the set of regular expressions match a set of messages, the adaptive ordering to produce an adaptively ordered set of regular expressions. The system determines, for a first message of the set of messages, whether a plurality of regular expressions of the adaptively ordered set of regular expressions match the first message. The system constructs a bi-directional graph representing the plurality of regular expressions that match the first message, and classifies a second message based on the adaptively ordered set of regular expressions and the bi-directional graph.

Abstract: In examples, an apparatus comprises: a memory, and a processor coupled to the memory. The processor to: adaptively order an ordered set of regular expressions based on training messages to produce a set of adaptively ordered regular expressions having an adaptive order, determine a first of the adaptively ordered regular expressions that matches an additional message, and determine whether a second of the adaptively ordered regular expressions matches the additional message. Responsive to determining that the second of the other of the adaptively ordered regular expressions matches the additional message, the processor to: classify the additional message with the first regular expression if the first regular expression has a higher priority in the adaptive order; and classify the additional message with the second regular expression if the second regular expression has a higher priority in the adaptive order.

Abstract: Examples relate to purging storage partitions of a database. The examples disclosed herein identify a first partition of a database to be purged and identify a data entry in the first storage partition, where the data entry is to be copied. Examples herein copy an updated version of the data entry to a future storage partition of the database and purge the first storage partition. A dummy data entry is created in a second storage partition of the database, where the dummy data entry identifies the future storage partition.

Abstract: According to an example, aggregation based event identification may include aggregating each of a plurality of source events by an event type of event types that represent dusters of the source events and/or a host of a source event of the source events to generate a reduced number of the source events. Aggregation based event identification may further include analyzing a characteristic for each of the reduced number of the source events, and assigning, based on the analysis of the characteristic for each of the reduced number of the source events, a characteristic weight to each of the reduced number of the source events. Further, aggregation based event identification may include aggregating the characteristic weights for each of the reduced number of the source events to determine an aggregated event issue weight for each of the reduced number of the source events.

Abstract: A non-transitory, computer readable storage device includes software that, while being executed by a processor, causes the processor to choose, based on user activity, a plurality of candidate parameters to be monitored from a plurality of event messages. Further, the processor executes the software to estimate a level of similarity between the chosen plurality of candidate parameters by computing a similarity score for at least two of the chosen candidate parameters. Still further, the processor executes the software to determine a plurality of parameters from the chosen candidate parameters if the similarity score for the plurality of parameters is greater than a threshold.

Abstract: Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

Abstract: In some examples, host IDs associated with the respective source component and a result of a partial calculation of an aggregate metric score may be received from each of a plurality of source components associated with a host of an information technology (IT) system. The partial calculation based on individual metric scores may be associated with the respective source component. The aggregate metric score may be calculated using the partial calculations and the host IDs, the aggregate metric score associated with metric measurements of the source components.

Abstract: In some examples, time-series datasets received from a system may be temporally aligned. In some examples, one of the time-series datasets may be deduplicated. In some examples, whether an anomaly has occurred in the system may be determined based on a non-deduplicated time-series dataset of the time-series datasets.

Abstract: Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

Abstract: In examples, an apparatus comprises: a memory, and a processor coupled to the memory. The processor to: adaptively order an ordered set of regular expressions based on training messages to produce a set of adaptively ordered regular expressions having an adaptive order, determine a first of the adaptively ordered regular expressions that matches an additional message, and determine whether a second of the adaptively ordered regular expressions matches the additional message. Responsive to determining that the second of the other of the adaptively ordered regular expressions matches the additional message, the processor to: classify the additional message with the first regular expression if the first regular expression has a higher priority in the adaptive order; and classify the additional message with the second regular expression if the second regular expression has a higher priority in the adaptive order.

Abstract: According to an example, aggregation based event identification may include aggregating each of a plurality of source events by an event type of event types that represent dusters of the source events and/or a host of a source event of the source events to generate a reduced number of the source events. Aggregation based event identification may further include analyzing a characteristic for each of the reduced number of the source events, and assigning, based on the analysis of the characteristic for each of the reduced number of the source events, a characteristic weight to each of the reduced number of the source events. Further, aggregation based event identification may include aggregating the characteristic weights for each of the reduced number of the source events to determine an aggregated event issue weight for each of the reduced number of the source events.

Abstract: A plurality of log messages may be clustered into a plurality of clusters. For each of the plurality of log messages, the log message may be partitioned into a series of substrings. At least two of the plurality of clusters may be selected. For each one of the at least two selected clusters, a parsing rule may be generated corresponding to a plurality of substrings each of which are at a given location of a respective one of the log messages of the plurality of log messages in the one of the selected cluster.

Abstract: Examples relate to purging storage partitions of a database. The examples disclosed herein identify a first partition of a database to be purged and identify a data entry in the first storage partition, where the data entry is to be copied. Examples herein copy an updated version of the data entry to a future storage partition of the database and purge the first storage partition. A dummy data entry is created in a second storage partition of the database, where the dummy data entry identifies the future storage partition.

Abstract: A non-transitory, computer readable storage device includes software that, while being executed by a processor, causes the processor to choose, based on user activity, a plurality of candidate parameters to be monitored from a plurality of event messages. Further, the processor executes the software to estimate a level of similarity between the chosen plurality of candidate parameters by computing a similarity score for at least two of the chosen candidate parameters. Still further, the processor executes the software to determine a plurality of parameters from the chosen candidate parameters if the similarity score for the plurality of parameters is greater than a threshold.

Abstract: Prioritizing log messages can include generating a cluster of a plurality of log messages relating to an event and receiving feedback from a number of users relating to an event relevance of the cluster. Prioritizing can also include isolating a number of log messages based on the feedback and predicting a number of future events utilizing the isolated number of log messages.