Abstract: The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

Abstract: The technology disclosed relates to learning how to efficiently display anomalies in performance data to an operator. In particular, it relates to assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and training a classifier that implements at least one circumstance-specific detector used to monitor a time series of performance data or to detect patterns in the time series. The training includes producing a time series of anomaly event candidates including corresponding event information used as input to the detectors, generating feature vectors for the anomaly event candidates, selecting a subset of the candidates as anomalous instance data, and using the feature vectors for the anomalous instance data and implicit and/or explicit feedback from users exposed to a visualization of the monitored time series annotated with visual tags for at least some of the anomalous instances data to train the classifier.

Abstract: The disclosed technology teaches configuring and reconfiguring an application running on a system, receiving a test configuration file with performance evaluation criteria and bounds for configuration dimensions defining a configuration hyperrectangle. The technology includes instantiating a reference instance and a test instance, subject to similar operating stressors and automatically testing alternative configurations within the configuration hyperrectangle, configuring and reconfiguring components of the test instance in the test cycles at configuration points within the configuration hyperrectangle, and applying a test stimulus to both instances for a dynamically determined cycle time.

Abstract: The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to differential analysis of sets of time series pairs. In particular, it relates to building estimators of magnitude of difference between two time series. After the basic estimators are built, they are combined into ensemble estimators using linear or nonlinear prediction models to improve their accuracy. In one application, the ensemble is used for estimating the magnitudes of difference over sets of metric pairs observed from distributed applications and systems running over a computer network. The metric pairs are then ranked in decreasing order of magnitude of difference to guide an operator in prioritizing his root cause analysis of faults, thereby reducing the time-to-resolution of problems.

Abstract: The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

Abstract: The technology disclosed relates to learning how to efficiently display anomalies in performance data to an operator. In particular, it relates to assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and training a classifier that implements at least one circumstance-specific detector used to monitor a time series of performance data or to detect patterns in the time series. The training includes producing a time series of anomaly event candidates including corresponding event information used as input to the detectors, generating feature vectors for the anomaly event candidates, selecting a subset of the candidates as anomalous instance data, and using the feature vectors for the anomalous instance data and implicit and/or explicit feedback from users exposed to a visualization of the monitored time series annotated with visual tags for at least some of the anomalous instances data to train the classifier.

Abstract: The technology disclosed relates to maintaining up to date software version data in a network. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections. It further relates to collecting current software version information for the processes, updating the network topology with the current software version for particular process running on a particular host when it differs from a stored software version in the network topology, reassigning the particular host to a sub-cluster within the service cluster according to the current software version, and monitoring the updated sub-cluster within the service cluster.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to learning how to efficiently display anomalies in performance data to an operator. In particular, it relates to assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and training a classifier that implements at least one circumstance-specific detector used to monitor a time series of performance data or to detect patterns in the time series. The training includes producing a time series of anomaly event candidates including corresponding event information used as input to the detectors, generating feature vectors for the anomaly event candidates, selecting a subset of the candidates as anomalous instance data, and using the feature vectors for the anomalous instance data and implicit and/or explicit feedback from users exposed to a visualization of the monitored time series annotated with visual tags for at least some of the anomalous instances data to train the classifier.

Abstract: The technology disclosed relates to detecting anomalous behavior of network components in a complex network setting.

Abstract: The technology disclosed relates to building ensemble analytic rules for reusable operators and tuning an operations monitoring system. In particular, it relates to analyzing a metric stream by applying an ensemble analytical rule. After analysis of the metric stream by applying the ensemble analytical rule, quantized results are fed back for expert analysis. Then, one or more type I or type II errors are identified in the quantized results, and one or more of the parameters of the operators are automatically adjusted to correct the identified errors. The metric stream is further analyzed by applying the ensemble analytical rule with the automatically adjusted parameters.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to sub-clustering within service clusters in real-time. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections, wherein the node data includes software versions of the processes and process data with configuration files and clustering the multiple hosts with the service clusters into the sub-clusters based at least in part on the software versions.

Abstract: The technology disclosed relates to sub-clustering within service clusters in real-time. In particular, it relates to accessing a network topology that records node data and connection data including processes running on numerous hosts grouped into local services on the hosts, the local services running on multiple hosts grouped into service clusters and sub-clusters of service clusters, and network connections used by the service clusters to connect the hosts grouped into service connections, wherein the node data includes software versions of the processes and process data with configuration files and clustering the multiple hosts with the service clusters into the sub-clusters based at least in part on the software versions.

Abstract: The technology disclosed relates to understanding traffic patterns in a network with a multitude of processes running on numerous hosts. In particular, it relates to using at least one of rule based classifiers and machine learning based classifiers for clustering processes running on numerous hosts into local services and clustering the local services running on multiple hosts into service clusters, using the service clusters to aggregate communications among the processes running on the hosts and generating a graphic of communication patterns among the service clusters with available drill-down into details of communication links. It also relates to using predetermined command parameters to create service rules and machine learning based classifiers that identify host-specific services. In one implementation, user feedback is used to create new service rules or classifiers and/or modify existing service rules or classifiers so as to improve accuracy of the identification of the host-specific services.

Abstract: The technology disclosed relates to differential analysis of sets of time series pairs. In particular, it relates to building estimators of magnitude of difference between two time series. After the basic estimators are built, they are combined into ensemble estimators using linear or nonlinear prediction models to improve their accuracy. In one application, the ensemble is used for estimating the magnitudes of difference over sets of metric pairs observed from distributed applications and systems running over a computer network. The metric pairs are then ranked in decreasing order of magnitude of difference to guide an operator in prioritizing his root cause analysis of faults, thereby reducing the time-to-resolution of problems.