Abstract: Methods and systems described herein are directed to classifying log messages generated by event sources of a distributed computing systems. Methods and systems generate a Grok expression and determine log-message metadata for each log message generated by the event sources. For each log message, the log message is classified based on the corresponding Grok expression and log-message metadata. Classified log messages may be used to perform troubleshooting and root cause analysis of the event sources.

Abstract: The current document is directed to methods and systems that automatically identify log/event-message traces and computational-entity transactions within collections and/or streams of log/event messages. Automated identification of log/event-message traces provides the basis for automated interpretation, by automated computer-system administration-and-the management subsystems, of the information represented by collections and/or streams of log/event messages. Disclosed approaches to automatically identifying log/event-message traces and computational-entity involve identifying log/event-message types, generating time-series-like log/event-message-type occurrence signals from log/event-message collections and/or streams, and computing cross correlations between pairs of log/event-message-type occurrence signals.

Abstract: The current document is directed to methods and systems that efficiently cache log/event messages in log/event-message systems incorporated within distributed computer facilities. The log/event-message systems provide the data-collection, data-storage, and data-querying functionalities that provide a basis for distributed log-analytics systems which, in turn, provide a basis for automated and semi-automated system-administration-and-management systems. Efficient caching significantly extends the period of time that networking failures and log/event-message processing delays can be tolerated by log/event-message systems without significant loss of information. Rather than caching individual log/event messages, message collectors that employ the currently disclosed technologies cache information regarding log/event-message types, leading to efficient compression of the cached information.

Abstract: Automated methods and systems for generating Grok expressions for extraction of metric data from any type of log message are described. Method and systems include construction of a directed graph from Grok patterns. A sample log message is selected from log messages that record metrics values of a desired metric. The directed graph is used to construct a Grok expression from the sample log message. The Grok expression is then used to parse log messages that are of the same type or format as the sample log message to extract the desired metric data from the log messages. The metric may in turn be used to troubleshoot problems anchor identifying potential root causes of problems in a data center or other type of distributed computing system.

Abstract: The current document is directed to methods and systems that efficiently transmit and process log/event messages within and among distributed computer facilities. By digesting and condensing log/event messages at the message-collector level, the volume of data transmitted from message collectors to message-ingestion-and-processing systems is greatly reduced, which increases system efficiencies by decreasing network overheads and which provides sufficient additional computational bandwidth at the message-collector level to allow message collectors to offload many message-processing tasks from message-ingestion-and-processing system and other downstream processing systems.

Abstract: The present disclosure provides an approach for training a machine learning model by first training the model on a generic dataset and then iteratively training the model on “easy” domain specific training data before moving on to “difficult” domain specific training data. Inputs of a domain-specific dataset are run on the generically-trained model to determine which inputs generate an accuracy score above a threshold. The inputs with an accuracy score above a threshold are used to retrain the model, along with the corresponding outputs. The retraining continues until all domain specific dataset has been used to train the model, or until no remaining inputs of the domain specific dataset generate an accuracy score, when run on the model, that is above a threshold.

Abstract: An example apparatus includes memory, and at least one processor to execute instructions to assign first containers to a first cluster and second containers to a second cluster based on the first containers including first allocated resources that satisfy a first threshold number of allocated resources and the second containers including second allocated resources that satisfy a second threshold number of allocated resources, determine a representative interaction count value for a first one of the first containers, the representative interaction count value based on a first network interaction metric corresponding to an interaction between the first one of the first containers and a combination of at least one of the first containers and at least one of the second containers, and generate a priority class for the first one of the first containers based on the representative interaction count value.

Abstract: System and computer-implemented method for constructing a topology for an application distributed over multiple virtual computing instances in which a set of resource utilization metrics are collected for multiple computing instances. A propagation sequence caused by an execution of the application is determined based on the set of resource utilization metrics. A graph may be created with the propagation sequence, wherein each virtual computing instance in the multiple computing instances is a possible node in the graph and the graph includes all nodes associated with the application.

Abstract: System and computer-implemented method for managing workloads in a computing environment use collected resource utilization metrics for a workload of a compute instance running in the computing environment that are superimposed to produce a unified time series of the resource utilization metrics for the workload. Undesired periodic patterns are then removed from the unified time series of the resource utilization metrics, which is used to identify the compute instance as a particular type of compute instances. Based on the identification, an action is recommended and implemented on the compute instance.

Abstract: Example methods and apparatus to determine container priorities in virtualized computing environments are disclosed herein. Examples include: a cluster controller to classify a first container into a cluster based on the first container having a number of distinct allocated resources within a threshold number of distinct allocated resources corresponding to a second container; a container ranking generator to: determine resource utilization rank values for a resource usage type of a number of distinct allocated resources, the resource utilization rank values indicative that the first container utilizes the resource usage type more than the second container; determine an aggregated resource utilization rank value for the first container based on aggregating ones of the resource utilization rank values corresponding to the first container; and a container priority controller to generate a priority class for the first container based on the aggregated resource utilization rank value.

Abstract: This disclosure describes how data supporting real-time reporting services can be cached during a log intake process. In particular, instead of caching all the log data being generated by an operational system, only the log data relevant to existing queries associated with the real-time reporting services are cached. In some embodiments, only particular metrics contained within the log data are stored for rapid access by the real-time reporting services.

Abstract: Example methods and apparatus to determine container priorities in virtualized computing environments are disclosed herein. Examples include: a cluster controller to classify a first container into a cluster based on the first container having a number of distinct allocated resources within a threshold number of distinct allocated resources corresponding to a second container; a container ranking generator to: determine resource utilization rank values for a resource usage type of a number of distinct allocated resources, the resource utilization rank values indicative that the first container utilizes the resource usage type more than the second container; determine an aggregated resource utilization rank value for the first container based on aggregating ones of the resource utilization rank values corresponding to the first container; and a container priority controller to generate a priority class for the first container based on the aggregated resource utilization rank value.

Abstract: Embodiments disclosed herein relate to a method, system, and computer-readable medium for monitoring an application executing across a plurality of containers. A performance monitor requests a list of containers created on at least one computing system. The performance monitor retrieves information associated with a creation of each container in the list. The performance monitor parses the information associated with each container in the list to identify a cluster of related containers that are running the applications. The performance monitor displays a topology that relates the containers of the cluster to resources in the at least one computing system. The performance monitor identified a pair of containers that are negatively correlated based on the topology. The performance monitor adjusts the application to remove the negative correlation between the pair of containers.

Abstract: A system and method for sampling application programming interface (API) execution traces in a computer system uses feature vectors of the API execution traces that are generated using trace-context information. The feature vectors are then used to group the API execution traces into clusters. For the cluster, sampling rates are generated so that a sampling rate is assigned to each of the clusters. The sampling rates are then applied to the API execution traces to adaptively sample the API execution traces based on the clusters to which the API execution traces belong.

Abstract: Examples disclosed herein provide for the handling of a print job for a printer via a mobile device. The mobile device receives a notification from a computing device to indicate the print job is available for printing. Upon the mobile device joining a wireless network associated with the printer, the mobile device delivers the print job from the mobile device to the printer via the wireless network.

Abstract: Disclosed are various embodiments for automating the prediction of workload tenures in datacenter environments. In some embodiments, parameters are identified for a plurality of workloads of a software defined data center. A machine learning model is trained to determine a predicted tenure based on parameters of the workloads. A workload for the software defined data center is configured to include at least one workload parameter. The workload is processed using the trained machine learning model to determine the predicted tenure. An input to the machine learning model includes the at least one workload parameter.

Abstract: System and computer-implemented method for constructing a topology for an application distributed over multiple virtual computing instances in which a set of resource utilization metrics are collected for multiple computing instances. A propagation sequence caused by an execution of the application is determined based on the set of resource utilization metrics. A graph may be created with the propagation sequence, wherein each virtual computing instance in the multiple computing instances is a possible node in the graph and the graph includes all nodes associated with the application.

Abstract: System and computer-implemented method for managing workloads in a computing environment use collected resource utilization metrics for a workload of a compute instance running in the computing environment that are superimposed to produce a unified time series of the resource utilization metrics for the workload. Undesired periodic patterns are then removed from the unified time series of the resource utilization metrics, which is used to identify the compute instance as a particular type of compute instances. Based on the identification, an action is recommended and implemented on the compute instance.

Abstract: The present disclosure provides an approach for training a machine learning model by first training the model on a generic dataset and then iteratively training the model on “easy” domain specific training data before moving on to “difficult” domain specific training data. Inputs of a domain-specific dataset are run on the generically-trained model to determine which inputs generate an accuracy score above a threshold. The inputs with an accuracy score above a threshold are used to retrain the model, along with the corresponding outputs. The retraining continues until all domain specific dataset has been used to train the model, or until no remaining inputs of the domain specific dataset generate an accuracy score, when run on the model, that is above a threshold.

Abstract: In one example, configuration data and resource utilization data associated with a plurality of virtual machines in a data center may be retrieved. Further, a cluster analysis may be performed on the configuration data and the resource utilization data to generate a plurality of clusters. Each cluster may include identical virtual machines from the plurality of virtual machines. Furthermore, for each cluster, the identical virtual machines in a cluster may be consolidated to execute in a host computing system such that physical memory pages are shared by the consolidated identical virtual machines in the cluster.