Abstract: A method is provided for tracking and capturing troubleshooting user activities performed for identifying a cause of an alert. Specifically, the method includes identifying an alert among a listing of alerts for troubleshooting the alert. The method also includes generating a dashboard template for an alert by tracking and capturing user activities performed while troubleshooting the alert, wherein the dashboard template comprises correlation coefficients of metrics and alert metric information. The method further includes generating a dynamic contextual dashboard in context of the alert using the dashboard template. The method further includes scoring and ranking a dynamic contextual dashboard associated with the alert using the dashboard template assigned to the alert cluster.

Abstract: A computing system may include at least one memory and at least one processor coupled to the at least one memory. The at least one processor may be configured to calculate a trace distribution associated with an execution path of an instruction set. The at least one processor may be further configured to assign a score to the instruction set based on the trace distribution associated with the execution path of the instruction set. The at least one processor may be further configured to control handling of an event associated with an execution of the instruction set based on the score.

Abstract: A computing system may include at least one memory and at least one processor coupled to the at least one memory. The at least one processor may be configured to calculate a trace distribution associated with an execution path of an instruction set. The at least one processor may be further configured to assign a score to the instruction set based on the trace distribution associated with the execution path of the instruction set. The at least one processor may be further configured to control handling of an event associated with an execution of the instruction set based on the score.

Abstract: A method for troubleshooting abnormal behavior of an application hosted on a networked computer system. The method may be implemented by a root cause analyzer. The method includes tracking a single application performance metric across all the clients of an application hosted on a networked computer system and analyzing an aggregated application based on the single application metric. The method involves determining outlier client attributes associated with an abnormal transaction of the application and ranking the outlier client attributes based on comparisons of historical and current abnormal transactions. The method associates one or more of the ranked outlier client attributes with the root cause of the current abnormal transaction. Association rule learning is used to associate one or more of the ranked outlier client attributes with the root cause.

Abstract: A method for troubleshooting abnormal behavior of an application hosted on a networked computer system. The method may be implemented by a root cause analyzer. The method includes tracking a single application performance metric across all the clients of an application hosted on a networked computer system and analyzing an aggregated application based on the single application metric. The method involves determining outlier client attributes associated with an abnormal transaction of the application and ranking the outlier client attributes based on comparisons of historical and current abnormal transactions. The method associates one or more of the ranked outlier client attributes with the root cause of the current abnormal transaction. Association rule learning is used to associate one or more of the ranked outlier client attributes with the root cause.

Abstract: Systems and techniques for identifying a common change window for one or more services implemented on one or more hosts include querying time series performance data for each host of a service to identify time slots of low resource consumption on the host, annotating the time slots with service tags, where the service tags identify host information and service information, creating groups of time slots using the service tags, using dynamic clustering to create clusters of hosts using the groups of time slots, and generating at least one common change window by eliminating duplicate hosts from the clusters of the hosts.

Abstract: A resource monitoring method may include determining, at a first monitoring node, a load level for each monitoring node of a plurality of monitoring nodes including the first monitoring node and a second monitoring node based on a namespace associated with the first monitoring node. The namespace may include an overlay namespace and a local namespace. The local namespace may identify objects being monitored by the first monitoring node. The overlay namespace may include local viewpoints for other monitoring nodes of the plurality of monitoring nodes including the second monitoring node. Each local viewpoint may identify one or more objects that are monitored by a respective other monitoring node. The method may further include prohibiting the first monitoring node from instituting a new object creation request if the load level of the second monitoring node is lower than the load level of the first monitoring node.

Abstract: A resource monitoring method may include receiving a request to perform a read operation on an object at a first monitoring node of a plurality of monitoring nodes, and determining whether or not a copy of the object is present in a namespace associated with the first monitoring node. The namespace may include an overlay namespace and a local namespace. The local namespace may identify objects being monitored by the first monitoring node. The overlay namespace may include local viewpoints for other monitoring nodes of the plurality of monitoring nodes. Each local viewpoint may identify one or more objects that are monitored by a respective other monitoring node. The method may further include performing, by the first monitoring node, the read operation on the object if the copy of the object is determined as present in the namespace associated with the first monitoring node.

Abstract: A resource monitoring method may include determining, at a first monitoring node, a load level for each monitoring node of a plurality of monitoring nodes including the first monitoring node and a second monitoring node based on a namespace associated with the first monitoring node. The namespace may include an overlay namespace and a local namespace. The local namespace may identify objects being monitored by the first monitoring node. The overlay namespace may include local viewpoints for other monitoring nodes of the plurality of monitoring nodes including the second monitoring node. Each local viewpoint may identify one or more objects that are monitored by a respective other monitoring node. The method may further include prohibiting the first monitoring node from instituting a new object creation request if the load level of the second monitoring node is lower than the load level of the first monitoring node.

Abstract: A resource monitoring method may include receiving a request to perform a read operation on an object at a first monitoring node of a plurality of monitoring nodes, and determining whether or not a copy of the object is present in a namespace associated with the first monitoring node. The namespace may include an overlay namespace and a local namespace. The local namespace may identify objects being monitored by the first monitoring node. The overlay namespace may include local viewpoints for other monitoring nodes of the plurality of monitoring nodes. Each local viewpoint may identify one or more objects that are monitored by a respective other monitoring node. The method may further include performing, by the first monitoring node, the read operation on the object if the copy of the object is determined as present in the namespace associated with the first monitoring node.

Abstract: Systems, methods and computer readable media that provide stateless fault tolerance and load balanced data collection using overlay namespaces are described. A cluster is used. Each node of the cluster may be a monitoring system. A data provider process may run on each node in the cluster. Each node has an overlay namespace which comprises one or more links to namespaces on other nodes, and local viewpoints of those linked namespaces. When a node detects a resource waiting to be monitored, it queries other nodes to determine whether object creation for that resource is allowed. It creates an object only if no other node is creating or has created an object for that resource.

Abstract: Systems, methods and computer readable media that provide stateless fault tolerance and load balanced data collection using overlay namespaces are described. A cluster is used. Each node of the cluster may be a monitoring system. A data provider process may run on each node in the cluster. Each node has an overlay namespace which comprises one or more links to namespaces on other nodes, and local viewpoints of those linked namespaces. When a node detects a resource waiting to be monitored, it queries other nodes to determine whether object creation for that resource is allowed. It creates an object only if no other node is creating or has created an object for that resource. A node may stop monitoring more resources if the load on the node reaches a specified threshold. The node may also stop monitoring a resource if it determines the load level on another node is at a predefined low level compared with its own load level.

Abstract: Systems and methods are disclosed that implement a data collection infrastructure that supports both agent-based and agentless data collection. Existing data collection scripts may be used, whether agent-based or agentless, and new scripts may be created that include commands that may execute either locally or remotely, as desired. These scripts, while executed locally, may interact with either the local machine or another remote machine for performing data collection, corrective actions, or other desired functionality. An execution context defines whether commands executed by the script are to execute locally or remotely, and a context handler allows processing those commands either locally or remotely depending on the execution context, transparently to the script. Data generated by remote execution may be transported back to the local machine for manipulation locally, transparently to the script.