Abstract: Embodiments detect differences between software systems by comparing statements collected therefrom in an order of execution. Highlighting point(s) of divergence between the executed statements allows rapid localization of differences between the software systems, which may be minor and otherwise difficult to discern within large volumes of underlying code. In some embodiments a highlighted departure in statement order may be attributable to slight code differences between the two software systems. In other embodiments the software systems may have identical code but reference different configuration data (e.g. as configuration files), a subtle distinction also revealed by comparing an order of executed statements. Certain embodiments may perform tracing/comparison between an order of execution of only selected statement types (e.g., SQL operations, database access, kernel events) based upon their specificity and ability to reveal significant functional differences.

Abstract: A computer-implemented method for monitoring programs may include (1) placing a program within an enclave that includes a protected address space that code outside of the protected address space is restricted from accessing, (2) hooking an application programming interface call within the program in the enclave to monitor the behavior of the program, (3) inserting an enclave entry instruction into code outside of the protected address space that the program accesses through the hooking of the application programming interface call, and (4) monitoring the behavior of the program by executing the program within the enclave in an attempt to force the program to use the hooked application programming interface call in order to access data outside the enclave. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A system that safely executes a native code module on a computing device. During operation, the system receives the native code module, which is comprised of untrusted native program code expressed using native instructions in the instruction set architecture associated with the computing device. The system then loads the native code module into a secure runtime environment, and proceeds to execute a set of instructions from the native code module in the secure runtime environment. The secure runtime environment enforces code integrity, control flow integrity, and data integrity for the native code module. Furthermore, the secure runtime environment moderates which resources can be accessed by the native code module on the computing device and/or how these resources can be accessed. By executing the native code module in the secure runtime environment, the system facilitates achieving native code performance for untrusted program code without a significant risk of unwanted side effects.

Abstract: A profile prediction system may identify one of multiple user profiles for a single computer. For example, a home computer may have multiple users that may not be targeted unless the user on the home computer can be identified. The system's user identification may be based on a clustering model that considers various browsing characteristics to identify different clusters that each correspond to a particular user or user profile. The model may be generated and refined by tracking web browsing over multiple sessions. Future activity on the computer may be used to identify which user is the source of the activity and the user may receive targeted content including advertisements.

Abstract: An apparatus, system, and method is disclosed for protecting against key logger malware. The protection includes protection form grabbing keylogger malware. In response to detecting a form submission event from a browser associated with a user entering data into a form, confidential data is cleared to prevent it being captured by malware. Additional protection of data inputs, entered at a driver level, may be provided as an additional level of protection against hook based malware operating at a virtual keyboard level or operating system level. Data inputs received at a physical driver level may be protected as they pass through a virtual keyboard level and an operating system level. The projection against malware may be provided as a preventive measure that does not require detection of the key logger malware itself.

Abstract: Management is provided for threads of a database system that is subject to a plurality of disparate bottleneck conditions for resources. A monitor thread retrieves, from a first thread, first monitor data for first bottleneck condition of a first type. The monitor thread compares the first monitor data to a trigger level for the first bottleneck condition and then determines, in response to the comparison of the first monitor data to the trigger level, a potential source of the first bottleneck condition. A potential blocker thread is identified based upon the potential source of the first bottleneck condition. The monitor thread retrieves, from the potential blocker thread, second monitor data for a second type of bottleneck condition that is different from the first type of bottleneck condition. Based upon monitor data, a blocking thread is identified, and a particular blocking solution is applied to the blocking thread.

Abstract: Management is provided for threads of a database system that is subject to a plurality of disparate bottleneck conditions for resources. A monitor thread retrieves, from a first thread, first monitor data for first bottleneck condition of a first type. The monitor thread compares the first monitor data to a trigger level for the first bottleneck condition and then determines, in response to the comparison of the first monitor data to the trigger level, a potential source of the first bottleneck condition. A potential blocker thread is identified based upon the potential source of the first bottleneck condition. The monitor thread retrieves, from the potential blocker thread, second monitor data for a second type of bottleneck condition that is different from the first type of bottleneck condition. Based upon monitor data, a blocking thread is identified, and a particular blocking solution is applied to the blocking thread.

Abstract: Systems, methods, architectures and/or apparatus providing a visualization tool wherein an initial or simplified correlation tree includes a path between two hierarchically related objects; namely, a root cause object and an object representing an entity associated with an event of interest caused by the root cause entity, wherein the correlation tree may be incrementally increased in size and complexity in response to user input, such as via a graphical user interface, such that the user attention is focused on the specific entities and their relationships to thereby enable a user to quickly understand the various failure relationships.

Abstract: A system comprising a processor adapted to activate multiple security levels for the system and a monitoring device coupled to the processor and employing security rules pertaining to the multiple security levels. The monitoring device restricts usage of the system if the processor activates the security levels in a sequence contrary to the security rules.

Abstract: Defect remediation in a system is disclosed. A defect is mapped to one or more remediation actions, at least in part by using a processor to generate and perform a defect-based query against one or more structured remediation action records. A remediation package is generated using the processor. The remediation package may include the one or more remediation actions and data associated with the defect. The remediation package may be sent to a destination associated with the defect.

Abstract: An information processing apparatus determines first message types that are not used for learning, on the basis of the appearance frequencies of individual message types obtained using a set of collected messages, and learns a message pattern which appears when a fault occurs and from which the first message types have been removed, from the set of messages and fault information. The information processing apparatus determines second message types that are not used for detection, on the basis of the appearance frequencies of individual message types obtained using a set of collected messages, generates a message pattern, from which the second message types have been removed, from the set of messages, and compares the message patterns with each other to detect a fault symptom in a system.

Abstract: A device includes a redundant region of a magnetoresistive random access memory (MRAM) array that includes first memory cells. The device includes a data region of the MRAM array that includes second memory cells. The device includes a fail address region of the MRAM array, a first row of the fail address region including validity data, wherein the validity data includes multiple validity indicators, a last row indicator, or both.

Abstract: Various embodiments are generally directed an apparatus and method for receiving an event notification for a pair of cluster nodes having a first cluster node and a second cluster node, the event notification indicating an occurrence of a takeover event or a giveback event. Further, various embodiments may include suspending copying of information from a source logical unit to a target logical unit, transferring one or more processes from the first cluster node to the second cluster node and resuming importation of information from the source logical unit to the target logical unit.

Abstract: A storage controller is configured to determine a reliability metric of a storage division of a solid-state storage medium based on one or more test read operations. The storage division may be retired based on the reliability metric and/or the age of the data on the storage division. A storage division comprising aged data may be marked for post-write reliability testing, which may comprise determining a post-write reliability metric in response to grooming and/or reprogramming the storage division. The storage controller may project the reliability metric of the storage division to the end of a predetermined data retention period. Portions of a storage divisions that exhibit poor reliability may be removed to improve the reliability of the storage division without taking the entire storage division out of service.

Abstract: A data leak prevention system includes an application, having source code that is unavailable or non-modifiable, resident on a client device. A system call is emittable by the application as a result of an action, and is to take place before a data leak event can occur. The action involves a document and i) latest full contents of the document, ii) metadata of the document, or iii) a combination of the latest full contents and the metadata. A system call interceptor agent is also resident on the client device. The interceptor agent includes a system call interceptor to intercept the system call emitted by the application and to suspend the system call. The system also includes a policy decision engine to analyze at least some of i) the latest full contents, ii) the metadata, or iii) the combination, and implement a policy action based upon the analysis.

Abstract: A method for job management in an HPC environment includes determining an unallocated subset from a plurality of HPC nodes, with each of the unallocated HPC nodes comprising an integrated fabric. An HPC job is selected from a job queue and executed using at least a portion of the unallocated subset of nodes.

Abstract: Scalable structured data store operations can include logging a number of detected corrupted records within a scalable structured data store, repairing the number of corrupted records within a number of nodes of the scalable structured data store, and predicting hardware failure based on the logged number of corrupted records.

Abstract: Disclosed is a unit for allowing a user, when any error occurs in a service, to easily ascertain the degree of influence on the service provision due to the error. In order to solve the above-described problem, there is provided a service management device including a graphing unit that graphically displays, on an identical time series graph, an access frequency to a predetermined service provided on a computer network and a predicted access frequency to the service in a state where no error occurs in the service, and displays an error occurrence time, on the time series graph, when the error occurs in the service.

Abstract: A network attached storage device may include at least one storage device, a network connection coupling the at least one storage device to a network and a processor coupled to the at least one storage device and to the network connection. The processor may be configured to monitor a plurality of operating parameters of the network attached storage; determine a state of a network attached storage based on at least two of the monitored plurality of operating parameters of the network attached storage; determine a current level of protection from among a predetermined plurality of levels of protection based on the determined state of the network attached storage, and provide an indication of the determined level of protection afforded by the network attached storage.

Abstract: A method of analyzing an occurrence of an error in a computer program executing on a data processing system includes receiving data that are associated with an execution leg of the computer program at the time of the error and restricting access to at least a portion of the data associated with the execution leg of the computer program based on an identification of the portion of the data associated with the execution leg of the computer program as being sensitive information.

Abstract: A method for processing commands includes receiving, for multiple commands, doorbells for writing to a send queue scheduler buffer on a host channel adapter (HCA). The send queue scheduler buffer is associated with a send queue scheduler. The method further includes detecting a potential deadlock of the send queue scheduler from processing a portion of the doorbells, writing a subset of the doorbells to a doorbell overflow buffer on a host, operatively connected to the HCA, based on detecting the potential deadlock, and discarding the subset by the send queue scheduler without processing the subset of the plurality of doorbells before discarding.

Abstract: Requests for content can be received from clients and forwarded to servers, and responses to the requests can be received from the servers and forwarded to the clients. A health model can also be maintained. The health model can be based on information in the responses and possibly also on information in the requests, and the health model can indicate the health of the servers in responding to different types of requests. The health model may differentiate between health in responding to requests with different features in URLs of the requests, such as different namespaces and/or different extensions.

Abstract: This application relates to a method of analyzing the memory usage being performed on a user terminal, the user terminal executing a plurality of application objects and the method includes (a) measuring an active virtual memory (AVM) usage being used in the plurality of application objects, (b) determining a physical memory usage from the active virtual memory when measuring the active virtual memory usage and (c) subtracting the physical memory usage from the measured active virtual memory usage to determine a swap unique memory usage. Therefore, it may be possible to efficiently measure the memory usage used only in the swap memory from the active virtual memory.

Abstract: An information processing apparatus includes a monitoring device including a first communication unit and a first processor. The first communication unit is configured to perform first communication using a first protocol and perform second communication using a second protocol different from the first protocol. The first processor is configured to conduct the first communication via the first communication unit to obtain first data and conduct first determination to determine whether the first data is obtained through the first communication. The first processor is configured to conduct, when it is determined that the first data is not obtained through the first communication, the second communication via the first communication unit to obtain the first data and conduct second determination to determine whether the first data is obtained through the second communication. The first processor is configured to output information on the basis of a determination result of the second determination.

Abstract: An application maturity illustration system is provided. Such a system may determine a maturity of a computer application, and display same. The determination may include determining an inventory score, an operational status, a management score reflective of a ratio of an actual management value to a desired management value, a risk score and a future score for the computer application. The future score may be reflective of a projected relative importance of the computer application. The processor may operate to display a GUI that includes inventory score, operational status score, management score, risk score and the future score in a horizontal row. The vertical column may be located either along the top most portion of the GUI with respect to a user viewing the GUI or at the bottom most portion of the GUI with respect to a user viewing the GUI. The GUI may also be configured to display a recovery exercise date region. The recovery exercise date region may be color-coded.

Abstract: An application maturity illustration system is provided. Such a system may determine a maturity of a computer application, and display same. The determination may include determining an inventory score, an operational status, a management score reflective of a ratio of an actual management value to a desired management value, a risk score and a future score for the computer application. The future score may be reflective of a projected relative importance of the computer application. The processor may operate to display a GUI that includes inventory score, operational status score, management score, risk score and the future score in a horizontal row. The vertical column may be located either along the top most portion of the GUI with respect to a user viewing the GUI or at the bottom most portion of the GUI with respect to a user viewing the GUI. The GUI may also be configured to display a recovery exercise date region. The recovery exercise date region may be color-coded.

Abstract: A failure symptom report device includes a processor configured to receive a message output from a system and related to configuration equipment of the system, and detect presence or absence of each of failure alerts. The failure alerts are generated in response to the received message on basis of detection conditions respectively. The detection conditions are respectively defined in accordance with different characteristics. The processor is configured to associate an actually occurred failure with a combination of the detected presence or absence of each of the failure alerts, count performance of failure prediction for each combination of the detected presence or absence of each of the failure alerts, and determine presence or absence of a failure symptom on basis of the counted performance of failure prediction and a combination of presence or absence of each of the failure alerts generated in response to a currently received message.

Abstract: Systems and methods are provided for analyzing operating metrics of monitored metric sources. Aspects of the present disclosure may present for display information associated with the monitored metric source and the analysis of its operating metrics. Analysis comprises determination of reference values and tolerance levels which represent allowable deviations from the reference values. Input data includes a measurement of an operating parameter and a time stamp. Input data may be saved to a data store for using in future analysis of other input data. When input data is determined to be outside the tolerance level, notifications may be issued to alert administrators or systems of the anomaly.

Abstract: An asset health monitoring system (AHMS) can assign a confidence indicator to some or all the monitored computing asset in a data center, such as computing systems or networking devices. In response to drops in the confidence indicators, the AHMS can automatically initiate testing of computing assets in order to raise confidence that the asset will perform correctly. Further, the AHMS can automatically initiate remediation procedures for computing assets that fail the confidence testing. By automatically triggering testing of assets and/or remediation procedures, the AHMS can increase reliability for the data center by preemptively identifying problems.

Abstract: A computer implemented method provides efficient monitoring and analysis of a program's memory objects in the operation stage. The invention can visualize and analyze a monitored program's data status with improved semantic information without requiring source code at runtime. The invention can provide higher quality of system management, performance debugging, and root-cause error analysis of enterprise software in the production stage.

Abstract: Processes, computer-readable media, and machines are disclosed for reducing a likelihood that active functional components fail in a computing system. An active monitoring component receives metrics associated with different active functional components of a computing system. The different active functional components contribute to different functionalities of the system. Based at least in part on the metrics associated with a particular active functional component, the active monitoring component determines that the particular active functional component has reached a likelihood of failure but has not failed. In response to determining that the particular active functional component has reached the likelihood of failure but has not failed, the active monitoring component causes a set of actions that are predicted to reduce the likelihood of failure.

Abstract: Methods, systems, and products predict locations of failures. Messages historically received are analyzed to predict a future failure. A pattern in the messages historically received is used to retrieve a template. A location of the future failure is predicted from the template.

Abstract: There are provided a data preprocessing device and a method thereof. A data preprocessing device according to an embodiment of the present disclosure includes a risk level analyzing unit configured to calculate a failure risk level of a target system using failure history information of the target system and characteristic information of the target system; a collection period setting unit configured to determine a data collection period from the target system according to the calculated failure risk level; and a preprocessing unit configured to preprocess data collected from the target system according to the data collection period.

Abstract: Embodiments are directed to establishing a model for testing cloud components and to preventing cascading failures in cloud components. In one scenario, a computer system models identified cloud components (including cloud hardware components and/or cloud software components) as health entities. Each health entity is configured to provide state information about the cloud component. The computer system establishes declarative safety conditions which declaratively describe cloud computing conditions that are to be maintained at the identified cloud components. The computer system then tests against the declarative safety conditions to determine which cloud components are or are becoming problematic. Upon determining that an error has occurred, the computer system notifies users of the error and the component at which the error occurred. Guarded interfaces are established to ensure that actions taken to fix the error do not cause further failures.

Abstract: Methods and a computing device are disclosed. A computing device may include a managed device having embedded firmware. When a failure occurs with respect to the managed device, drivers within the computing device may collect failure data from a driver stack of the computing device and from the managed device. The computing device may send the collected failure data to one or more second computing devices to be stored and analyzed. The computing device may include a health monitor for periodically collecting telemetry data from the computing device and the managed device. When the health monitor becomes aware of conditions indicative of a possible impending failure, the health monitor may trigger collection of sickness telemetry data from the computing device and the managed device. Collected data from the managed device may be made available to a vendor of the managed device.

Abstract: An asset health monitoring system (AHMS) can assign a confidence indicator to some or all the monitored computing asset in a data center, such as computing systems or networking devices. In response to drops in the confidence indicators, the AHMS can automatically initiate testing of computing assets in order to raise confidence that the asset will perform correctly. Further, the AHMS can automatically initiate remediation procedures for computing assets that fail the confidence testing. By automatically triggering testing of assets and/or remediation procedures, the AHMS can increase reliability for the data center by preemptively identifying problems.

Abstract: A method includes, in a host that stores data in a storage device, detecting an event that is indicative, statistically and not deterministically, of an imminent power shutdown in the host. A notification is sent to the storage device responsively to the detected event, so as to cause the storage device to initiate preparatory action for the imminent power shutdown.

Abstract: Embodiments are directed to predicting the health of a computer node using health report data and to proactively handling failures in computer network nodes. In an embodiment, a computer system monitors various health indicators for multiple nodes in a computer network. The computer system accesses stored health indicators that provide a health history for the computer network nodes. The computer system then generates a health status based on the monitored health factors and the health history. The generated health status indicates the likelihood that the node will be healthy within a specified future time period. The computer system then leverages the generated health status to handle current or predicted failures. The computer system also presents the generated health status to a user or other entity.

Abstract: The present subject matter discloses a method for predicting failure of hardware components. The method comprises obtaining a syslog file stored in a Hadoop Distributed File System (HDFS), where the syslog file includes at least one or more syslog messages. Further, the method comprises categorizing each of the one or more syslog messages into one or more groups based on a hardware component generating the syslog message. Further, a current dataset comprising one or more records based on the categorization is generated, where each of the one or more records include a syslog message from amongst the one or more syslog messages. The method further comprises analysing the current dataset for identifying at least one error pattern of syslog messages, based on a plurality of error patterns of reference syslog messages, for predicting failure of the hardware components.

Abstract: A fault monitoring, detection and analysis system obtains data (e.g. online service facts) from different data sources. Many times the data obtained from the different data sources is in different formats. The data is classified (e.g. into error, performance and usage events/facts) based on user configured multi-dimensional (time, topology, functional area) filter criteria. The data from the different data sources is normalized into a standard format and stored. The data may also be grouped and duplicates may be removed before and/or after the normalized data is stored. Analysis is performed on the normalized data. For example, the analysis may monitor for expected events, unexpected events, detect abnormal behavior of the system, and the like. Different users may submit different jobs to the system to obtain data from the data store. A reporting service exposes one or more views of the data and/or the analysis of the data.

Abstract: To detect a failure in each processor core appropriately. It is provided a network apparatus for transferring a packet, comprising: a control unit; and a network processor including a plurality of processor cores, each configured to perform a process of transferring a packet input over a network. The control unit being configured to: transmit a packet to the network processor; acquire a packet processing status of each of the plurality of processor cores; and monitor a status of the each of the plurality of processor cores based on the acquired packet processing status.

Abstract: A computer system is coupled to a plurality of subscribers via a network. The computer system obtains first presence information that corresponds to a first calendar of a user and obtains second presence information that corresponds to a second calendar of the user that is different from the first calendar. The computer system determines one or more presence states of the user including determining, based on presence information for the user that includes the first presence information and the second presence information, a first presence state of the user. The computer system provides the respective presence state of the user, selected from the one or more presence states of the user, to the subscribers via the network.

Abstract: Methods for a mobile device restarting subsystem software on a schedule that reduces the likelihood of subsystem failures without requiring a general system restart or impacting other subsystems. The mobile device may calculate a restart time window during which a first subsystem may be restarted efficiently and prior to the occurrence of software failures. Upon initialization of the first subsystem, a restart timer may be established which indicates the period since a previous restart of the first subsystem. Once the restart timer indicates a time within the restart time window, the mobile device may transmit request messages to other subsystems dependent upon the first subsystem. In response to a unanimous vote by the other subsystems or the restart timer exceeding the time restart window, the mobile device may restart the first subsystem. In an aspect, the mobile device may transmit the request messages at an increasing rate.

Abstract: In a system operations management apparatus, a burden to a system administrator when providing a decision criterion in detection of a failure in the future is reduced. The system operations management apparatus 1 includes a performance information accumulation unit 12, a model generation unit 30 and an analysis unit 31. The performance information accumulation unit 12 stores performance information including a plurality of types of performance values in a system in time series. The model generation unit 30 generates a correlation model including one or more correlations between the different types of performance values stored in the performance information accumulation unit 12 for each of a plurality of periods having one of a plurality of attributes.

Abstract: Identifying an inter-relationship between performance metrics of a computer system. It is proposed to convert performance metric signals, which represent variations of performance metrics over time, into quantized signals having a set of allowable discrete values. The quantized signals are compared to detect a correlation based on the timing of variations quantized signals. An inter-relationship between the performance metrics may then be identified based on a detected correlation between the quantized signals.

Abstract: Systems and methods of managing problem determination (PD) data provide for obtaining PD data from a plurality of data sources via an input/output (I/O) interface of a data management device and storing the PD data to a memory of the data management device. In addition, an automated diagnostic analysis of the PD data may be conducted on the data management device. An automated discovery manager may provide the ability to find new sources of PD data and to either reconfigure remote systems to send data to the data management device or to automatically retrieve data from remote systems on a configurable schedule. Dynamically updateable database of symptom information can also be used, wherein the data management device may include a dynamically updateable set of analysis modules with which to conduct analysis on the PD data.

Abstract: At least one value of abnormal metrics is identified as being an abnormal dimension value. A dominant dimension related to the anomaly is identified based on the identified abnormal dimension value.

Abstract: Techniques are described for detecting the occurrence of error scenarios occurring across a plurality of nodes. Embodiments retrieve a plurality of error scenario profiles. Each of the error scenario profiles specifies prerequisite criteria, the prerequisite criteria including at least one of (i) one or more errors and (ii) one or more conditions. The plurality of nodes is monitored to detect errors occurring on nodes within the plurality of nodes. Embodiments then detect the occurrence of an error scenario, when at least a portion the monitored errors match the prerequisite criteria specified in a first one of the error profiles and when the one or more conditions specified in the first error profile are satisfied.

Abstract: Processes, computer-readable media, and machines are disclosed for reducing a likelihood that active functional components fail in a computing system. An active monitoring component receives metrics associated with different active functional components of a computing system. The different active functional components contribute to different functionalities of the system. Based at least in part on the metrics associated with a particular active functional component, the active monitoring component determines that the particular active functional component has reached a likelihood of failure but has not failed. In response to determining that the particular active functional component has reached the likelihood of failure but has not failed, the active monitoring component causes a set of actions that are predicted to reduce the likelihood of failure.

Abstract: A recovery schedule storing means (81) stores a recovery schedule for a failure of a cloud service with respect to each computing resource type or each application service. A resource usage profile storing means (82) stores a resource usage profile specifying an application service or a computing resource used when each user uses the cloud service. A recovery time predicting means (83) predicts a service recovery time with respect to each user based on the resource usage profile and the recovery schedule. A recovery time presenting means (84) presents the predicted service recovery time to the user.