Vmware, Inc.

Clement Pang

Ashot Nshan Harutyunyan

Arnak Poghosyan

Naira Movses Grigoryan

George Oganesyan

Davit Baghdasaryan

Dev A Nag

Karen Avagyan

Computer-implemented methods and systems described herein perform intelligent sampling of application traces generated by an application. Computer-implemented methods and systems determine different sampling rates based on frequency of occurrence of trace types and/or frequency of occurrence of durations of the traces. Each sampling rate corresponds to a different trace type and/or different duration. The sampling rates for low frequency trace types and durations are larger than the sampling rates for high frequency trace types and durations. The relatively larger sampling rates for low frequency trace types and low frequency durations ensures that low frequency trace types and low frequency durations are sampled in sufficient numbers and are not passed over during sampling of the application traces. The set of sampled traces are stored in a data storage device.

Methods and systems for intelligent sampling of application traces

The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems. Call-trace-classification rules that are useful in multiple diagnoses are maintained as diagnosis tools for future diagnoses.

Automated methods and systems that facilitate root cause analysis of distributed-application operational problems and failures

The current document is directed to methods and systems that employ call traces collected by one or more call-trace services to generate call-trace-classification rules to facilitate root-cause analysis of distributed-application operational problems and failures. In a described implementation, a set of automatically labeled call traces is partitioned by the generated call-trace-classification rules. Call-trace-classification-rule generation is constrained to produce relatively simple rules with greater-than-threshold confidences and coverages. The call-trace-classification rules may point to particular services and service failures, which provides useful information to distributed-application and distributed-computer-system managers and administrators attempting to diagnose operational problems and failures that arise during execution of distributed applications within distributed computer systems. A first dataset is collected during normal distributed-application operation and a second dataset is collected during problem-associated or failure-associated operation of the distributed application. The first and second datasets are used to generate noise-subtracted call-trace-classification rules and/or diagnostic suggestions.

Automated methods and systems that facilitate root-cause analysis of distributed-application operational problems and failures by generating noise-subtracted call-trace-classification rules

In a computer-implemented method for handling of an index update, time series data is received at an ingestion node of a time series data monitoring system. An index update is determined based on the time series data. The index update is stored to an index database of the time series data monitoring system. The index update is forward to a plurality of query nodes of the time series data monitoring system.

Handling of an index update of time series data

In a computer-implemented method for querying a variably partitioned time series database, a query of a time series database is received, the query including a time range and a predicate comprising at least one dimension, wherein the time series database comprises a plurality of time series database schemas. At least one time series database schema of the time series database corresponding to the time range is determined. The query is divided into a plurality of sub-queries, wherein each sub-query of the plurality of sub-queries corresponds to one time series database schema of the plurality of time series database schemas. The plurality of sub-queries is executed to return a plurality of results.

Querying a variably partitioned time series database

In a computer-implemented method for maintaining a time series database including a plurality of time series database schemas, time series data including data points are received at an ingestion node of a time series database, the data points comprising a plurality of dimensions. A plurality of time series database schemas of the time series database is determined for storing the time series data. The time series data is ingested according to the plurality of time series database schemas, wherein each data point is stored according to each time series database schema of the plurality of time series database schemas, such that the time series database comprises multiple instances of each data point.

Time series database comprising a plurality of time series database schemas

In a computer-implemented method for adapting time series database schema of a time series database, time series data ingested into a time series database according to a time series database schema is accessed over a time period, wherein time series data comprises a plurality of dimensions. The time series data of the time period is analyzed to determine a data shape of the time series data of the time period. It is determined whether to adapt the time series database schema based at least in part on the data shape of the time series data of the time period. In some embodiments, the time series database schema is adapted based at least in part on the data shape of the time series data of the time period. Time series data is then ingested into the time series database according to the adapted time series database schema.

Adapting time series database schema

The current document is directed to methods and systems that employ distributed-computer-system metrics collected by one or more distributed-computer-system metrics-collection services, call traces collected by one or more call-trace services, and attribute values for distributed-computer-system components to identify attribute dimensions related to anomalous behavior of distributed-computer-system components. In a described implementation, nodes correspond to particular types of system components and node instances are individual components of the component type corresponding to a node. Node instances are associated with attribute values and node are associated with attribute-value spaces defined by attribute dimensions. A set of call traces is partitioned, by clustering. Using attribute values and call traces, attribute dimensions that are likely related to particular anomalous behaviors of distributed-computer-system components are determined by decision-tree-related analyses for each partition and are reported to one or more computational entities to facilitate resolution of the anomalous behaviors.

Methods and systems that identify dimensions related to anomalies in system components of distributed computer systems using clustered traces, metrics, and component-associated attribute values

In a computer-implemented method for adapting time series database schema, a plurality of queries to a time series database received over a time period is accessed, wherein time series data is ingested into the time series database according to a time series database schema, wherein time series data comprises a plurality of dimensions. The plurality of queries of the time period is analyzed to determine a relative frequency of the plurality of dimensions within the plurality of queries over the time period. It is determined whether to adapt the time series database schema based at least in part on the relative frequency of the plurality of dimensions within the plurality of queries over the time period.

In a computer-implemented method for proactive handling of an index update, a data point is received at an ingestion node of a time series data monitoring system. It is determined whether an update to a local index of the ingestion node is necessitated based on the data point and the local index. Provided the update to the local index is necessitated, an index entry corresponding to the data point in the local index is updated based on the data point. The index entry corresponding to the data point is marked with a volatile indicator, the volatile indicator indicating that receipt of an index update to a corresponding index entry at a durable index of the time series data monitoring system is unconfirmed. The index update to the durable index corresponding to the data point is initiated.

Handling time series index updates at ingestion

Computational processes and systems are directed to forecasting time series data and detection of anomalous behaving resources of a distributed computing system data. Processes and systems comprise off-line and on-line modes that accelerate the forecasting process and identification of anomalous behaving resources. In the off-line mode, recurrent neural network ('RNN') is continuously trained using time series data associated with various resources of the distributed computing system. In the on-line mode, the latest RNN is used to forecast time series data for resources in a forecast time window and confidence bounds are computed over the forecast time window. The forecast time series data characterizes expected resource usage over the forecast time window so that usage of the resource may be adjusted. The confidence bounds may be used to detect anomalous behaving resources. Remedial measures may then be executed to correct problems indicated by the anomalous behavior.

Processes and systems for forecasting metric data and anomaly detection in a distributed computing system

In a method for caching a generated query plan for time series data, a query plan for time series data is generated based on a query comprising an expression, the query plan including a path of execution for resolving the query. The path of execution of the query plan to resolve the query is executed. A result of the path of execution is returned as a response to the query. The query plan is cached for retrieval and execution responsive to receiving another query that matches the query, such that the query plan can be used to resolve the another query.

Method and system for caching a generated query plan for time series data

In a computer-implemented method for visualization of anomalies in time series data on a graphical user interface, a plurality of time series data is dynamically displayed in a graph of the graphical user interface, the plurality of time series data including data points represented as numerical measurements. An indication that a time series data of the plurality of time series data includes an anomaly is received. Responsive to receiving the indication that the time series data of the plurality of time series data includes an anomaly, a visualization of at least a region of the time series data including the anomaly is changed.

Visualization of anomalies in time series data

In a method for dynamic refresh of an index during query path generation for time series data, a query for time series data is received. During generation of a query plan based on the query, operations in a stage for a plurality of paths of execution are determined based at least in part on elements of the query, wherein execution of the stage comprises accessing an index of a plurality of indices. It is determined whether to refresh indices of a plurality of indices based on a potential usefulness of the indices in reducing a solution set for the stage of a path of execution of the plurality of paths of execution. The indices are selectively refreshed based on the potential usefulness of the indices in reducing a solution set for the stage of a path of execution of the plurality of paths of execution.

Method and system for dynamic refresh of an index during path analysis of query plan generation for time series data

In a method for generating a query plan for time series data, a query for time series data is received, the query including elements. The query is parsed to identify the elements and operators between the elements. First stages for a plurality of paths of execution are determined based at least in part on the elements and the operators. At least a first stage for the plurality of paths of execution is executed. The plurality of paths of execution is evaluated after completion of the first stage. Based on the evaluating, a subset of paths of execution is selected for continued execution and evaluation.

Growing community of inventors

Sunnyvale, CA, United States of America

Clement Pang