Abstract: A method and system for coordinating energy management in a virtualized data center including a plurality of physical servers and a plurality of virtual machines (VMs), includes analyzing status information about the virtualized data center; determining server utilization target settings for server consolidation from the analyzed status information; and executing the server consolidation according to the determined server utilization target settings. Server consolidation can be executed by determining an effective size of each of the VMs and placing the VMs on the servers in a selective manner using an independent workload VM placement process, a correlation-aware VM placement process, or a migration-cost and correlation-aware VM placement process.

Abstract: A method and apparatus for consolidating a plurality of applications into one or more servers. The method and apparatus organizes consolidation constraints representing preferences about placing applications into the one or more servers, and allocates the applications into the one or more servers in a manner that maximally satisfies the consolidation constraints.

Abstract: A method and system determines capacity needs of components in a distributed computer system. In the method and system, a pair-wise invariant network is determined from collected flow intensity measurements. The network includes at least two separate and unconnected pair-wise invariant subnetworks, each of the subnetworks including two of the flow intensity measurements connected by a pairwise invariant, each of the pair-wise invariants characterizing a constant relationship between their two connected flow intensity measurements. At least one overlay invariant is determined from the pair-wise invariant network and from the collected flow intensity measurements using a minimal redundancy least regression process. The capacity needs of the components are determined using the pair-wise and overlay invariants.

Abstract: A method system for diagnosing a detected failure in a computer system, compares a failure signature of the detected failure to an archived failure signature contained in a database to determine if the archived failure signature matches the failure signature of the detected failure. If the archived failure signature matches the failure signature of the detected failure, an archived solution is applied to the computer system that resolves the detected failure, the archived solution corresponding to a solution used to resolve a previously detected computer system failure corresponding to the archived failure signature in the database that matches the detected failure.

Abstract: A system and method for prioritizing alerts includes extracting invariants to determine a stable set of models for determining relationships among monitored system data. Equivalent thresholds for a plurality of rules are computed using an invariant network developed by extracting the invariants. For a given time window, a set of alerts are received from a system being monitored. A measurement value of the alerts is compared with a vector of equivalent thresholds, and the set of alerts is ranked.

Abstract: A method and system that automatically derives models between monitored quantities under non-faulty conditions so that subsequent faults can be detected as deviations from the derived models. The invention identifies unusual conditions for fault detection and isolation that is absent in rule-based systems.

Abstract: Systems and methods are disclosed that profile event sequences by creating a mixture model from the event sequences; estimating parameters for the mixture model; and applying the mixture model to profile the event sequences.

Abstract: A system and method for optimizing system performance includes applying sampling based optimization to identify optimal configurations of a computing system by selecting a number of configuration samples and evaluating system performance based on the samples. Based on feedback of evaluated samples, a location of an optimal configuration is inferred. Additional samples are generated towards the location of the inferred optimal configuration to further optimize a system configuration.

Abstract: Disclosed is a method and apparatus for performing capacity planning and resource optimization in a distributed system. In particular, the capacity needs of individual components (e.g., server, operating system, CPU, application software, memory, networking device, storage device, etc.) in a distributed system can be analyzed using relationships between measurements collected from the distributed system. These relationships, called invariants, do not change over time. From these measurements, a network of invariants are determined. The network of invariants characterize the relationships between the measurements. The capacity need of at least one component in the distributed system can be determined from the network of invariants.

Abstract: To determine the cause of a problem, evaluating and tracing how an individual request traverses through various components in the system makes possible new detection techniques. The present invention relates to detecting faults in a computer system. In accordance with an embodiment of the invention, a method and apparatus detects a fault in a system by receiving a request and generating a trace based on the request. The trace is a sequence of components used to service the request. The method and apparatus also compares the trace with a stored automaton to determine whether the trace is an anomaly. The stored automaton describes traces.

Abstract: Disclosed is a method and system for modeling invariant relationships between flow intensity measurements in a distributed system. In the method, a measurement is randomly selected from a plurality of flow intensity measurements. The method searched for relationships between the randomly selected measurement and each remaining one of the plurality of flow intensity measurements, and each of the flow intensity measurements having a relationship with the randomly selected measurement is grouped into a cluster with the randomly selected measurement. The method than determines relationships between all of the flow intensity measurements in the cluster. This method is repeated with the remaining flow intensity measurements until all of the flow intensity measurements are grouped into a cluster.

Abstract: A method and system that automatically derives models between monitored quantities under non-faulty conditions so that subsequent faults can be detected as deviations from the derived models. The invention identifies unusual conditions for fault detection and isolation that is absent in rule-based systems.

Abstract: A system failure detection method that employs both supervised and unsupervised monitoring that models the contextual dependencies between the system inputs u and database usages x. By means of statistical learning, the space x is transformed into two subsets of variables, {tilde over (x)}(1) and {tilde over (x)}(2) . The subset {tilde over (x)}(1) encapsulates the dependencies of x with respect to the system load, and each variable in that subset has a highly correlated partner derived from the input u, which serves as a ‘teacher’ to monitor the activities of that variable. The subset {tilde over (x)}(2) contains variables that are less correlated or uncorrelated with respect to the input and are monitored in an unsupervised manner. By combining the supervised and unsupervised monitoring, a high detection rate and minimal false positives are experienced, especially those resulting from workload changes.

Abstract: To determine the cause of a problem, evaluating and tracing how an individual request traverses through various components in the system makes possible new detection techniques. The present invention relates to detecting faults in a computer system. In accordance with an embodiment of the invention, a method and apparatus detects a fault in a system by receiving a request and generating a trace based on the request. The trace is a sequence of components used to service the request. The method and apparatus also compares the trace with a stored automaton to determine whether the trace is an anomaly. The stored automaton describes traces.