Abstract: A computer system includes a processor, a memory, a data collector, a relationships analyzer, and a topological map generator. The data collector retrieves performance data in a specific set of performance categories for computing resources in a computing system for a time interval. The relationships analyzer, for each computing resource-to-computing resource pair in the computing system, performs a correlation analysis of the respective behavior values of the computing resources in the pair, and identifies the computing resource-to-computing resource pairs that have correlation values exceeding a pre-determined threshold level as having performance interdependencies. The topological map generator prepares an undirected graph of the computing resources that have performance interdependencies, and displays the undirected graph as a topographic map of the computing resources in the computing system.

Abstract: A computer system includes a processor, a memory, a data collector, a relationships analyzer, and a topological map generator. The data collector retrieves performance data in a specific set of performance categories for computing resources in a computing system for a time interval. The relationships analyzer, for each computing resource-to-computing resource pair in the computing system, performs a correlation analysis of the respective behavior values of the computing resources in the pair, and identifies the computing resource-to-computing resource pairs that have correlation values exceeding a pre-determined threshold level as having performance interdependencies. The topological map generator prepares an undirected graph of the computing resources that have performance interdependencies, and displays the undirected graph as a topographic map of the computing resources in the computing system.

Abstract: A computer system includes a processor, a memory, a data collector, a relationships analyzer, and a topological map generator. The data collector retrieves performance data in a specific set of performance categories for computing resources in a computing system for a time interval. The relationships analyzer, for each computing resource-to-computing resource pair in the computing system, performs a correlation analysis of the respective behavior values of the computing resources in the pair, and identifies the computing resource-to-computing resource pairs that have correlation values exceeding a pre-determined threshold level as having performance interdependencies. The topological map generator prepares an undirected graph of the computing resources that have performance interdependencies, and displays the undirected graph as a topographic map of the computing resources in the computing system.

Abstract: A computer system for classifying one or more servers by server type in a networked computing system to institute server-type based monitoring and or maintenance of the networked computing system. The computer system includes a processor, a memory, a data receiver, a server signature generator, and a server-type tagging service. The data receiver collects server performance data for a first server over a time interval. The server signature generator determines a signature of the first server based on the collected server performance data. The server-type tagging service compares the signature of the first server to a signature of a second server of known server type, determines a similarity of the signature of the first server to the signature of the second server, and, based on the similarity, classifies the first server as being of the same server type as the second server.

Abstract: A computer system for classifying one or more servers by server type in a networked computing system to institute server-type based monitoring and or maintenance of the networked computing system. The computer system includes a processor, a memory, a data receiver, a server signature generator, and a server-type tagging service. The data receiver collects server performance data for a first server over a time interval. The server signature generator determines a signature of the first server based on the collected server performance data. The server-type tagging service compares the signature of the first server to a signature of a second server of known server type, determines a similarity of the signature of the first server to the signature of the second server, and, based on the similarity, classifies the first server as being of the same server type as the second server.

Abstract: A computer system includes a processor, a memory, a data collector, a relationships analyzer, and a topological map generator. The data collector retrieves performance data in a specific set of performance categories for computing resources in a computing system for a time interval. The relationships analyzer, for each computing resource-to-computing resource pair in the computing system, performs a correlation analysis of the respective behavior values of the computing resources in the pair, and identifies the computing resource-to-computing resource pairs that have correlation values exceeding a pre-determined threshold level as having performance interdependencies. The topological map generator prepares an undirected graph of the computing resources that have performance interdependencies, and displays the undirected graph as a topographic map of the computing resources in the computing system.

Abstract: Systems and methods for enriching events using data correlation are described herein. At least some embodiments include a method for enriching events reflecting the state of a plurality of computer systems, the method including storing a plurality of event messages and system metric data that includes service metric data, determining a degree of correlation between a system metric and at least one of a plurality of service metrics, and enriching an event message of the plurality of event messages based at least in part on the degree of correlation. At least one system metric data value triggers the event message. The degree of correlation is based at least in part on the system metric data and the service metric data.

Abstract: A baseline adjusting technique allows automatically adjust the baselines of metrics affected by a configuration change a monitored system. If a configuration change is detected, a performance management system retrieves linkages between the changed configuration parameter and one or more metrics. The performance management system then adjusts the baselines of the metric using the baseline adjusting algorithm retrieved from the linkage.

Abstract: Embodiments disclosed herein can significantly optimize a root cause analysis and substantially reduce the overall time needed to isolate the root cause or causes of service degradation in an IT environment. By building on the ability of an abnormality detection algorithm to correlate an alarm with one or more events, embodiments disclosed herein can apply data correlation to data points collected within a specified time window by data metrics involved in the generation of the alarm and the event(s). The level of correlation between the primary metric and the probable cause metrics may be adjusted using the ratio between theoretical data points and actual points. The final Root Cause Analysis score may be modified depending upon the adjusted correlation value and presented for user review through a user interface.

Abstract: An improved performance management technique allows automatic determination dynamic thresholds of a metric based on a baseline of the matching pattern. A pattern matching process is conducted against a set of baseline patterns to find the matching pattern. If a matching pattern is found, the baseline of the matching pattern is used as the dynamic threshold. A series of sanity checks are performed to reduce any false alarms. If the metric does not follow any pattern, a composite of baselines is selected as the dynamic threshold.

Abstract: Systems and methods for enriching events using data correlation are described herein. At least some embodiments include a method for enriching events reflecting the state of a plurality of computer systems, the method including storing a plurality of event messages and system metric data that includes service metric data, determining a degree of correlation between a system metric and at least one of a plurality of service metrics, and enriching an event message of the plurality of event messages based at least in part on the degree of correlation. At least one system metric data value triggers the event message. The degree of correlation is based at least in part on the system metric data and the service metric data.

Abstract: A baseline adjusting technique allows automatically adjust the baselines of metrics affected by a configuration change a monitored system. If a configuration change is detected, a performance management system retrieves linkages between the changed configuration parameter and one or more metrics. The performance management system then adjusts the baselines of the metric using the baseline adjusting algorithm retrieved from the linkage.

Abstract: An improved performance management technique allows automatic determination dynamic thresholds of a metric based on a baseline of the matching pattern. A pattern matching process is conducted against a set of baseline patterns to find the matching pattern. If a matching pattern is found, the baseline of the matching pattern is used as the dynamic threshold. A series of sanity checks are performed to reduce any false alarms. If the metric does not follow any pattern, a composite of baselines is selected as the dynamic threshold.

Abstract: A baseline technique allows reducing the number of threshold violation predictions that need to be generated in a performance monitoring system. One or more baselines may be calculated based on long-term trends in a monitored metric. If the metric is within the baseline, then predictions regarding short-term trends in the metric may be omitted. If the metric is outside the baseline, then short-term trends may be analyzed to predict possible threshold violations.

Abstract: Embodiments disclosed herein can significantly optimize a root cause analysis and substantially reduce the overall time needed to isolate the root cause or causes of service degradation in an IT environment. By building on the ability of an abnormality detection algorithm to correlate an alarm with one or more events, embodiments disclosed herein can apply data correlation to data points collected within a specified time window by data metrics involved in the generation of the alarm and the event(s). The level of correlation between the primary metric and the probable cause metrics may be adjusted using the ratio between theoretical data points and actual points. The final Root Cause Analysis score may be modified depending upon the adjusted correlation value and presented for user review through a user interface.

Abstract: A system is provided to monitor network performances. The system maintains a database of performance abnormalities, alarms and events from a system of monitored elements. The system automatically identifies a possible cause of a specific alarm by correlating the specific alarm with a plurality of events using the database. The system displays the cause of the specific alarm. The database includes alarms and events of network devices, network systems, and network applications. The specific alarm consists of a notification of an occurrence of the plurality of events.

Abstract: A method and apparatus for network management is described. In one embodiment, a method comprises collecting performance data having accompanying meta data including information defining the performance management data and information indicating operations to be performed on the performance management data, and generating output data for display using collected performance management data according to the information indicating the operations to be performed on the performance management data.