Abstract: A method, computer system, and a computer program product are provided for dynamic viewing of an operation graph depicting a distributed workload in an Information Technology system. A list may be received as input and may include selected nodes. A sub-graph may be abstracted from a global graph. The sub-graph and the global graph may depict interactions among ops objects of the distributed workload using nodes and edges. First nodes may be removed from the global graph according to the list. Direct edges between remaining nodes from the global graph may be maintained. A first indirect edge may be generated based on the removed first nodes. The first indirect edge may run between a first remaining node and a second remaining node. The sub-graph may be presented removed from the global graph.

Abstract: Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to integrate documentation knowledge with log mining data. A non-limiting example computer-implemented method includes determining a message-message relationship based on log message documentation and building a first subgraph based on the message-message relationship. The method further includes receiving a first message log entry having a message identifier and message field data. A second message log entry is correlated with the first message log entry based on at least one of the message identifier and the message field data. A second subgraph is built that includes the first message log entry and the second message log entry. The method includes building a graph that includes the first subgraph and the second subgraph.

Abstract: According to an aspect, a method includes searching for a correlated log identifier in a correlation database based on detecting a metrics-based anomaly. The method also includes providing, in a problem diagnosis, related log information associated with the correlated log identifier based on locating one or more log entries including the correlated log identifier in a same time window as the metrics-based anomaly. The method further includes searching for a correlated metric in the correlation database based on detecting a log-based anomaly and providing, in the problem diagnosis, related metric information associated with the correlated metric based on locating one or more metrics records including the correlated metric in the same time window as the log-based anomaly.

Abstract: Techniques include generating a log sequence for new logs that have been received, searching a log sequence database for the log sequence having been generated, and determining that the log sequence is anomalous in response to not finding an identical log sequence in the log sequence database. In response to the log sequence not being found in the log sequence database, the log sequence is compared to a graph of historical log sequences to find a closest sequence path to one or more historical log sequences. An anomaly of the log sequence is diagnosed based on an occurrence at which the log sequence deviates from the closest sequence path of the one or more historical log sequences.

Abstract: According to an aspect a computer-implemented method includes identifying a plurality of metrics and log identifiers that describe similar information as a plurality of documentation-based correlation data. One or more metric pair correlations are identified. One or more log frequency correlations are identified by temporal correlation. A plurality of correlated metric-log pairs is identified. A correlation database is populated with the documentation-based correlation data, the one or more metric pair correlations, the one or more log frequency correlations, and the correlated metric-log pairs to support anomaly detection in one or more monitored computer systems.

Abstract: Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to integrate documentation knowledge with log mining data. A non-limiting example computer-implemented method includes determining a message-message relationship based on log message documentation and building a first subgraph based on the message-message relationship. The method further includes receiving a first message log entry having a message identifier and message field data. A second message log entry is correlated with the first message log entry based on at least one of the message identifier and the message field data. A second subgraph is built that includes the first message log entry and the second message log entry. The method includes building a graph that includes the first subgraph and the second subgraph.

Abstract: A method, computer system, and a computer program product are provided for dynamic viewing of an operation graph depicting a distributed workload in an Information Technology system. A list may be received as input and may include selected nodes. A sub-graph may be abstracted from a global graph. The sub-graph and the global graph may depict interactions among ops objects of the distributed workload using nodes and edges. First nodes may be removed from the global graph according to the list. Direct edges between remaining nodes from the global graph may be maintained. A first indirect edge may be generated based on the removed first nodes. The first indirect edge may run between a first remaining node and a second remaining node. The sub-graph may be presented removed from the global graph.

Abstract: Techniques include generating a log sequence for new logs that have been received, searching a log sequence database for the log sequence having been generated, and determining that the log sequence is anomalous in response to not finding an identical log sequence in the log sequence database. In response to the log sequence not being found in the log sequence database, the log sequence is compared to a graph of historical log sequences to find a closest sequence path to one or more historical log sequences. An anomaly of the log sequence is diagnosed based on an occurrence at which the log sequence deviates from the closest sequence path of the one or more historical log sequences.

Abstract: According to an aspect, a method includes searching for a correlated log identifier in a correlation database based on detecting a metrics-based anomaly. The method also includes providing, in a problem diagnosis, related log information associated with the correlated log identifier based on locating one or more log entries including the correlated log identifier in a same time window as the metrics-based anomaly. The method further includes searching for a correlated metric in the correlation database based on detecting a log-based anomaly and providing, in the problem diagnosis, related metric information associated with the correlated metric based on locating one or more metrics records including the correlated metric in the same time window as the log-based anomaly.

Abstract: A computer-implemented method includes receiving, by a processor, real time operation data related to an application, identifying components of the application based on the operation data, extracting relationships and interdependencies between the components, and generating a graph of the identified components, the relationships and the interdependencies. The method also includes determining one or more dynamic metrics of the identified components, the one or more dynamic metrics indicative of interactions between the components, extracting statistical information describing at least one of performance and resource consumption based on the operation data, incorporating the dynamic metrics into the graph, determining a behavior of at least one component based on a pattern of appearance of the at least one component in the graph, and generating a model of the application based on the identified components and the determined behaviors.