Abstract: Predictive models are widely used for tasks in many domains. The present invention addresses the problem of prediction of non-stationary processes by dynamically managing multiple models. The system comprises a model assessor, a model adapter, a plurality of sub-models, a plurality of model combiner functions, training data that is used to estimate model parameters, and test data that is used to test for change points. Two processes are described, one for handling data updates and another that addresses prediction requests.

Abstract: A method and system are described for end-user transaction recognition based on server data such as sequences of remote procedure calls (RPCs). The method may comprise machine-learning techniques for pattern recognition such as Bayesian classification, feature extraction mechanisms, and a dynamic-programming approach to segmentation of RPC sequences. The method preferably combines information-theoretic and machine-learning approaches. The system preferably includes a learning engine and an operation engine. A learning engine may comprise a data preparation subsystem (feature extraction) and a Bayes Net learning subsystem (model construction). The operation engine may comprise transaction segmentation and transaction classification subsystems.

Abstract: Systems and methods for instance counting and for the identification of a temporal pattern in an event sequence. The system addresses the use of “earliest-first” and “no-reuse” policies as criteria for the correctness of counting. The system also achieves higher performance than conventional methods by utilizing incremental computation.

Abstract: Systems and methods are provided for exploratory analysis of event messages. The invention includes a parsing engine to translate textual messages into structured event data, a selection and control engine (SCE) to provide data management and communication channels for a set of analysis methods, and viewers to support different kinds of analysis methods. The invention further includes a mechanism for viewers to exchange information, a mechanism for interactively and iteratively refining parsing rules, and a mechanism to visualize events through event graphs.

Abstract: A new form of pattern is provided, referred to as a mutual dependence pattern or m-pattern. The m-pattern captures mutual dependence among a set of items. Intuitively, the m-pattern represents a set of items that often occur together. In our experience, such m-patterns often provide great values for certain tasks, such as event correlation in event management. Further, an efficient algorithm is provided for discovering all m-patterns in data for a given minimum mutual dependence threshold. Specifically, a linear algorithm is provided for testing whether a pattern is an m-pattern. Further, a pruning algorithm is provided that prunes the search space effectively. Still further, a level-wise algorithm for mining m-patterns is provided.

Abstract: An adaptive throttling system for minimizing the impact of non-production work on production work in a computer system. The adaptive throttling system throttles production work and non-production work to optimize production. The adaptive throttling system allows system administrators to specify a quantified limit on the performance impact of non-production or utility work on production work. The throttling rate of the utility is then automatically determined by a supervisory agent, so that the utilities' impact is kept within the specified limit. The adaptive throttling system adapts dynamically to changes in workloads so as to ensure that valuable system resources are well utilized and utility work is not delayed unnecessarily.

Abstract: Automated or autonomic techniques for managing deployment of one or more resources in a computing environment based on varying workload levels. The automated techniques may comprise predicting a future workload level based on data associated with the computing environment. Then, an estimation is performed to determine whether a current resource deployment is insufficient, sufficient, or overly sufficient to satisfy the future workload level. Then, one or more actions are caused to be taken when the current resource deployment is estimated to be insufficient or overly sufficient to satisfy the future workload level. Actions may comprise resource provisioning, resource tuning and/or admission control.

Abstract: Techniques for performing adaptive and robust prediction. Prediction techniques are adaptive in that they use a minimal amount of historical data to make predictions, the amount of data being selectable. The techniques are able to learn quickly about changes in the workload traffic pattern and make predictions, based on such learning, that are useful for proactive response to workload changes. To counter the increased variability in the prediction as a result of using minimal history, robustness is improved by checking model stability at every time interval and revising the model structure as needed to meet designated stability criteria. Furthermore, the short term prediction techniques can be used in conjunction with a long term forecaster.

Abstract: Systems and methods are described for the execution and authoring of policies that use event rates for event management. The first system addresses policy execution. Included in this system are: a controller that provides overall operational control, a grouping engine, a rate detector, and a rate diagnoser. The second system automates the construction of event rate policies based on primary information sources (e.g., topology, inventory). The components of this system include: an authoring user interface, source-specific hierarchy generators, an event group generator and hierarchy builder, and a threshold constructor.

Abstract: A system and method is described for generic automated tuning for performance management. The system comprises a target to be controlled and a generic automated tuning agent (GATA) that performs this control. The controlled target provides interfaces to metrics relating to workload, service levels, and configuration information, as well as a means to adjust tuning controls that determine resource allocations within the target. The GATA inputs the metrics, estimates new tuning control settings based on service objectives specified by administrators, and outputs the tuning control settings.

Abstract: A method, computer program product, and data processing system for constructing a self-managing distributed computing system comprised of “autonomic elements” is disclosed. An autonomic element provides a set of services, and may provide them to other autonomic elements. Relationships between autonomic elements include the providing and consuming of such services. These relationships are “late bound,” in the sense that they can be made during the operation of the system rather than when parts of the system are implemented or deployed. They are dynamic, in the sense that relationships can begin, end, and change over time. They are negotiated, in the sense that they are arrived at by a process of mutual communication between the elements that establish the relationship.

Abstract: Data with multiple attributes are separated into groups by performing at least the following steps for each group to be defined: (1) selecting a first subset of the attributes to be first attributes; and (2) selecting a second subset of the attributes to be second attributes. Patterns that occur a predetermined number of times in the data are determined by using the groups. A third part of a definition for a group includes the number of records having the group and item attributes. Groups are sorted into levels and each group has a number of predecessor relationships and a number of successor relationships with other groups. The groups then provide a mining space describing the data, and the groups are termed “mining camps.” The mining camps are searched for patterns that occur a predetermined number of times. The searching determines predecessor relationships and uses the predecessor relationships to speed processing.

Abstract: Systems and methods are provided for automating navigation between dynamic data that has dissimilar structures, such as navigating between relational tables that have only a subset of their columns in common. That is, given a source dataset and source element collection, we want to navigate to an element collection in one or more target datasets. The automated navigation system includes an inter-dataset navigation engine that determines the best matching element collection within a plurality of target datasets. One method employed includes finding a descriptor of the target element collection in a target dataset. Then, a distance metric is computed between each source and target element. Lastly, a list that contains an entry for each target dataset along with its associated target element collection and distance value is output for use in a particular analysis task.

Abstract: The present invention comprises a method of relating characteristics gleaned by monitoring application transaction flows (and the decomposition thereof) to produce performance metrics useful to characterize the efficiency and performance of web transactions used in a web-based application. These metrics can assist application designers and developers in reorganizing their application content, programs, and transports to provide improved service to their consumer. Events are generated and composed into predefined activities on a web transaction basis. The performance metric is then derived that entails a relationship between at least two different activities that gives insight into the performance characteristics of the web transaction. By using the derived performance metrics, designers and developers of web pages can judge the effects of changes to their application relative to efficiency and performance. Different applications can also be compared and contrasted using these metrics.

Abstract: Techniques for mining or discovering one or more patterns in an input data set, wherein the input data set is characterized by attributes, comprises the following steps. First, the technique includes mapping attributes of the input data set to mapping values. Then, one or more candidate patterns are formed as groupings of two mapping values that occur within a predefined time period. Next, for each of the one or more candidate patterns, a qualification function is computed and a result of the qualification function is compared with at least one predefined threshold value. The one or more candidate patterns whose qualification function results are greater than or equal to the predefined threshold value are identified as one or more qualified patterns.

Abstract: A technique is provided for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices. The technique comprises the following steps. First, in association with an event cache, event data representing past or historical events associated with the network of computing devices being managed by the event management system is obtained. Next, a first pattern is found or detected in the obtained event data associated with the event cache. The pattern is then classified. Then, at least one correlation rule is constructed based on the classified pattern. Lastly, in association with the event cache, the one or more events included in the pattern are replaced with a composite or cumulative event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

Abstract: A method, system and program storage device for measurement acquisition using predictive models which: (a) can improve scalability; (b) can accommodate devices that operate in a disconnected mode; and (c) enable integration of data from sources with different time granularities. Various features can be embodied in software and an object-oriented implementation is described. Different implementations are described, such as standalone predictive models implemented only on a manager (for example systems management/load balancing) or managed system (for example router management); or a parallel implementation with predictive models running on both the manager and managed (agent) systems (for example financial trading or system health monitoring). In a parallel model implementation, the agent constructs a predictive model that is conveyed to the manager system. The models are used in parallel, possibly with no communication for an extended time.

Abstract: Methods and apparatus are described that use models of measurement variables to provide self-adjusting policies that: (a) reduce the administrative overhead of specifying thresholds and (b) provide a means for pro-active management by automatically constructing warning thresholds based on the probability of an alarm occurring within a time horizon. The invention includes components for model construction, threshold construction, policy evaluation, and action taking. Several kinds of meta policies are used in accordance with the invention to provide adaptation and pro-active management.

Abstract: Techniques for ordering categorical attributes so as to better visualize data are provided. In accordance with one embodiment of the invention, an ordering algorithm comprises the steps of: (a) translating the discrete ordering problem to a continuous optimization problem; (b) solving the continuous optimization problem; and (c) mapping an optimal continuous solution to the closest discrete solution.

Abstract: A system and method are described for constructing and implementing generic software agents for automated tuning of computer systems and applications. The framework defines the modules and interfaces to allow agents to be created in a modular fashion. The specifics of the target system are captured by adaptors that provide a uniform interface to the target system. Data in the agent is managed by a metric manager, and controller modules implement the desired control algorithms. The modular structure and common interfaces allow for the construction of generic agents that are applicable to a wide variety of target systems, and can use a wide variety of control algorithms.