Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: A monitoring device responds to status data to detect storms, analysis, and to attempt to remediate those storms. The monitoring device several types of storms, for each of which it has a technique for analysis of the storm. The monitoring device can determine if the storm is due to resource contention, excess or unbalanced performance activity, or network degradation. Once analyzed, the monitoring device analyzes the storm, and attempts to remediate the cause of the storm.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: Computing devices, each of which monitors information in a monitoring environment, take on the role of a controller for some of them, separating the (real or virtual) elements of the environment into subsets. Computing devices provide their results to a unification device, which combines them into a monitoring parameter. Each computing device monitors its parameters based on a timestamp, so unification devices can determine whether results from those computing devices represent the same state of the environment. Unification devices divide the results from their computing devices into uniform durations. Even if results don't reflect the same environment state, unification devices can still approximate results for unification. Elements can be reassigned on time boundaries, or can be duplicated, with unification devices still able to unify results. Predicted queries can be pre-computed.

Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase “best practices,” and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as “processor cycle utilization >90%.

Abstract: A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)'s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP's cloud services inclu

Abstract: Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.

Abstract: Network monitoring views can be recorded, replayed and shared. A monitoring system receives monitoring data, in response to which a monitoring view can be constructed. The monitoring data is maintained in memory or mass storage. One or more monitoring views can later be constructed in response to user preferences, even if those users would not have known to select those particular preferences or construct those particular monitoring views at the time. The monitoring views constructed in response to that monitoring data can be presented to users in a simulation of the problem, as if it were occurring at that time. Users can send particular monitoring views to others, with both the effects that the monitoring view can be preserved as part of a trouble report, and the persons receiving the monitoring view can have useful insight into what problem the user has pointed to.

Abstract: A network monitoring device responds to network status data (whether “pushed” from the network device or “pulled” from the network device) to maintain a buffer of saved status data. The network status data is reordered, manipulated, and presented to users of the network monitoring device in order. The monitoring device can provide a status report of the network environment. When network status data is delayed too long, the monitoring device can discard the network status data, or reduce its weighted consideration. The monitoring device attempts to balance accuracy and latency by adjusting wait time for network status data. The monitoring device maintains a record of the amount of network status data it receives and processes from each network device and each network device's ability to provide accurate and complete information to operators and users in a distributed network monitoring environment.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: One network monitoring system maintains both information regarding historical activity and emergent activity of the network. Comparison of recent activity of the network with historical activity allows the system to determine whether recent network activity is within the realm of normal. The system maintains data structures representing a p.d.f. for observable values of network parameters. Such data structures are maintained both for historical and for emergent activity of the network. Recent activity can be compared with the p.d.f. for historical activity to aid in determining whether that recent activity is within the realm of normal. Network activity not within the realm of normal can include values of observable network parameters too high or too low to be consistent with historical activity of the network, or other values too unlikely to be consistent with historical activity at the network.

Abstract: A monitoring device responds to status data pushed from a network device, and also manages a link with another network device, the link allowing the monitoring device to pull status data from the second network device. The monitoring device receives packets including status, the data indicating activity for one or more clock ticks. The monitoring device can compute statistical measures, rather than the network device. The monitoring device maintains the status data in a buffer. The monitoring device lags actual activity, but has is more likely to capture delayed packets. The network device sends packets as wrappers, each wrapper indicating sets of status information. When the information in a wrapper crosses a clock tick boundary, the monitoring device allocates reported activity among clock ticks, assuming that activity follows a uniform distribution.

Abstract: Computing devices, each of which monitors information in a monitoring environment, take on the role of a controller for some of them, separating the (real or virtual) elements of the environment into subsets. Computing devices provide their results to a unification device, which combines them into a monitoring parameter. Each computing device monitors its parameters based on a timestamp, so unification devices can determine whether results from those computing devices represent the same state of the environment. Unification devices divide the results from their computing devices into uniform durations. Even if results don't reflect the same environment state, unification devices can still approximate results for unification. Elements can be reassigned on time boundaries, or can be duplicated, with unification devices still able to unify results. Predicted queries can be pre-computed.

Abstract: A monitoring device responds to status data to detect storms, analysis, and to attempt to remediate those storms. The monitoring device several types of storms, for each of which it has a technique for analysis of the storm. The monitoring device can determine if the storm is due to resource contention, excess or unbalanced performance activity, or network degradation. Once analyzed, the monitoring device analyzes the storm, and attempts to remediate the cause of the storm.