Abstract: Some embodiments provide a novel method for monitoring health of LFEs of a logical network. For an LFE implemented by multiple PFEs, a health analytics manager identifies a set of one or more metrics associated with each PFE implementing the LFE. The health analytics manager uses the set of metrics to compute a health score for the LFE. Then, the health analytics manager provides the health score in a report to provide an indication regarding the monitored health of the LFE. The set of metrics used to compute the health score for the LFE includes, in some embodiments, at least one metric for each PFE implementing the LFE.

Abstract: Some embodiments provide a novel method of assessing health of a software managed network (SMN) that includes multiple forwarding elements that exchange data messages with each other. A health analytics manager collects performance metrics from control-plane components of the SMN that configure the forwarding elements of the SMN to forward data messages. The health analytics manager also collects performance metrics from data-plane components including the forwarding elements of the SMN. Then, the health analytics manager generates one health score from the collected performance metrics of the control-plane and data-plane components to express an overall health of the SMN.

Abstract: Some embodiments provide a novel method for monitoring health of logical networks. For a logical network including multiple LFEs, a health analytics manager identifies a set of one or more metrics associated with each LFE in the logical network. The health analytics manager uses the set of metrics to compute a health score for the logical network. Then, the health analytics manager provides the health score in a report to provide an indication regarding the monitored health of the logical network. In some embodiments, at least one LFE is implemented by multiple PFEs, and the set of metrics includes metrics associated with each of the PFEs implementing the at least one LFE.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, merges two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two attribute sets. In some embodiments, a visualization process includes identifying machines as members of groups and identifying machines that are connected. The visualization process, in some embodiments, also generates a graphical user interface that can be used to select groups of machines, domains, or individual machines and displays contextual attributes relevant to the selected group, domain, or machine.

Abstract: Systems and methods are described for providing a graphical user interface (“GUI”) for graph-based visualizations of network flows using entity clustering. In an example, an application service can periodically execute a job for assigning network entities to clusters according to a clustering type. The job can also include creating metadata about each cluster. The application service can store the assignments in a cache. A user can select to display a visualization of the network in the GUI based on the clustering type. The application service can detect any entities without cluster assignments and create a best guess assignment for them. The GUI can then display a visualization of the network according to the selected clustering type.

Abstract: The disclosure herein describes managing the execution of ML pipelines based at least in part on a dependency graph using a feature service. A plurality of feature creator processes are scheduled for execution using a set of feature creation resources. The scheduling is based at least in part on a dependency graph which describes dependency relationships between the plurality of feature creator processes and raw data sets stored in a raw data cache. The scheduled feature creator processes are then executed, wherein feature sets are created from the executed feature creator processes. The features sets are stored in a feature cache and the stored feature sets are exposed to a feature consumer using a feature interface. The use of the dependency graph and the raw data and feature caches enables the disclosure to reduce duplicated effort and resource usage across multiple pipelines that are executed on the system.

Abstract: An example method of analyzing workloads executing in a network managed virtualized computing system includes: presenting, by a network analyzer, a first view of the workloads on a canvas to a first user; receiving, at the network analyzer, first user input to create a first label, the first label initially disassociated with security policies of a network manager managing a software defined network used by the workloads; receiving, at the network analyzer, second user input to assign the first label to at least one of the workloads; and presenting, by the network analyzer, a second view of the workloads on the canvas to the first user having a first group of the at least one workload and a second group having workloads other than the at least one workload.

Abstract: Some embodiments provide a novel method for monitoring health of an SMN that includes multiple networking components. A health analytics manager identifies a set of one or more metrics associated with the network components of the SMN. The health analytics manager uses the set of metrics to compute a first health score for the SMN. Then, the health analytics manager presents the first health score in a UI along with (1) data regarding how the first health score was computed, and (2) a set of one or more parameters for a user to modify how the health for the SMN is computed. After receiving from the user one or more modifications to at least one of the parameters, the health analytics manager computes a second health score for the SMN based on the modified set of parameters.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, merges two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two attribute sets. In some embodiments, a visualization process includes identifying machines as members of groups and identifying machines that are connected. The visualization process, in some embodiments, also generates a graphical user interface that can be used to select groups of machines, domains, or individual machines and displays contextual attributes relevant to the selected group, domain, or machine.

Abstract: Some embodiments provide a mechanism to automatically group workloads of a network into clusters of related workloads. The method of some embodiments displays consolidated workload data for a network. The method, for each of multiple workloads: (1) receives a set of identifiers characterizing the workload; and (2) converts the set of identifiers to a vector representation of the workload. The method then identifies clusters of workloads based on the vector representations of the workloads. The method then displays the workloads grouped in the identified clusters and displays data flows between the clusters of workloads. Converting the set of identifiers to a vector representation of the workload may include applying a similarity metric to the set of identifiers.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, identifies at least two received attribute sets from two different host computers that relate to a same set of flows between a same set of source machines and a same set of destination machines. The appliance merges the two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two identified attribute sets, in some embodiments.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, identifies at least two received attribute sets from two different host computers that relate to a same set of flows between a same set of source machines and a same set of destination machines. The appliance merges the two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two identified attribute sets, in some embodiments.

Abstract: Some embodiments provide a novel method for receiving a plurality of attribute sets from a set of host computers, each attribute set associated with a group of one or more flows that is created by using a key to associate individual flows into the group of flows. The appliance, in some embodiments, merges two identified attribute sets into one merged attribute set and analyzes the merged attribute set to identify a set of properties of the flows in the groups of flows associated with the two attribute sets. In some embodiments, a visualization process includes identifying machines as members of groups and identifying machines that are connected. The visualization process, in some embodiments, also generates a graphical user interface that can be used to select groups of machines, domains, or individual machines and displays contextual attributes relevant to the selected group, domain, or machine.

Abstract: Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines.

Abstract: Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines, each host computer in these embodiments executes a context engine and one or more attribute-based service engines. Through the GI agents of a host's machines, the context engine of that host in some embodiments collects contextual attributes associated with network and/or process events on the machines, and provides the contextual attributes to the service engines to use to identify service rules for processing.

Abstract: Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines.