Abstract: Automated computer-implemented methods and systems for discovering clusters of alerts triggered by abnormal events occurring with objects in a data center are described. In one aspect, alerts with start times in a sliding run-time window are retrieved from an alerts database. Each alert corresponds to a run-time event occurring with an object of the data center. Clusters of alerts in the sliding run-time window are detected based on the start times of the alerts and topological proximity of the objects. High priority alerts in the clusters of alerts are determined based on alert types. The events associated with discovered clusters of alerts and high priority alerts are displayed in a graphical user interface (“GUI”). Time evolution clustering of alerts and coverage evolution of alerts are over time based on the start times of the alerts and topological proximity of objects exhibiting abnormal behavior in the data center.

Abstract: Automated computer-implemented processes and systems manage and troubleshoot a service provided by a distributed application executing in a distributed computing system. Processes query objects of the distributed computing system to identify candidate objects for addition to the service. Processes generate recommendations in a graphical user interface (“GUI”) that enable a user to select and enroll the one or more candidate objects into the service via the GUI. Processes monitor a key performance indicator (“KPI”) of the service for violations of a corresponding service level object (“SLO”) threshold. When the KPI violates the SLO threshold, processes determine a root cause of a performance problem with the service based on a metric-association rule associated with the KPI violation of the SLO threshold and displays the performance problem and a recommendation that corrects the performance problem in a GUI.

Abstract: Methods and systems described herein automate various aspects of troubleshooting a problem in a distributed computing system for various forms of object information regarding objects of the distributed computing system. In one aspect, the object information includes metrics, log messages, properties, network flows, events, and application traces. Methods and systems learn interesting patterns contained in the object information. The interesting patterns include change points in metrics and network flows, changes in the types of log messages, broken correlations between events, anomalous event transactions, atypical histogram distributions of metrics, and atypical histogram distributions of span durations in application traces. The interesting patterns are displayed in a graphical user interface (“GUI”) that enables a user to assign a label identifying a problem associated with the interesting patterns.

Abstract: Methods and systems described herein automate troubleshooting a problem in execution of an application in a distributed computing. Methods and systems learn interesting patterns in problem instances over time. The problem instances are displayed in a graphical user interface (“GUI”) that enables a user to assign a problem type label to each historical problem instance. A machine learning model is trained to predict problem types in executing the application based on the historical problem instances and associated problem types. In response to detecting a run-time problem instance in the execution of the application. the machine learning model is used to determine one or more problem types associated with the run-time problem instance. The one or more problem types are rank-ordered and a recommendation may be generated to correct the run-time problem instance based on the highest ranked problem type.

Abstract: Methods and systems are directed to finding various types of evidence of performance problems with objects in a data center, troubleshooting the performance problems, and generating recommendations for correcting the performance problems. A performance problem with an object of a data center, such as a server computer, an application, or a virtual machine (“VM”), may result from performance problems associated with other objects of the data center. The methods and systems detect origins of performance problems with objects for which no alerts and parameters for detecting the performance problems have been defined or detect performance problems related to alerts that fail to point to a root cause of the performance problem.