Oracle International Corporation

Jae Young Yoon

Sreeji Krishnan Das

Dhileeban Kumaresan

Venktesh Alvenkar

Harish Akali

Konstantinos Morfonios

Karl Dias

Leonidas Galanis

Adrienne Wong

Zhongtang Cai

Mirza Mohsin Beg

Kusumaharanadh Poduri

Benoit Dageville

Efstratios Papadomanolakis

Romain Colle

Hari Krishna Galla

Bo Gong

Qinghui H Altmar

Mehmet Fidanboylu

Tom Hsu

Rodney Graham

Amr Fawzy Fahmy

Eric L Sutton

Chandra Sekhar Komali

Techniques for performing analytics using automatically generated labels for time series data and numerical lists are disclosed. In some embodiments, a system loads a set of one or more time series datasets. A respective time series dataset may include a set of data points based on varying values of a metric of one or more computing resources over a window of time. The system assigns labels to a subset of the data points in the time series datasets. The label assigned to a given data point may be descriptive of a pattern reflected by the data point relative to other data points in the time series. The system further identifies a pattern of automatically assigned labels that is indicative of an event affecting the one or more computing resources. Responsive to identifying the pattern of labels, the system may trigger a responsive action.

Automatically-generated labels for time series data and numerical lists to use in analytic and machine learning systems

Techniques for leveraging frequent patterns identified in a captured workload are provided. In one approach, multiple frequent patterns detected in a captured workload may be ordered by frequency to determine, for example, which patterns should be targeted for optimization. In another approach, a model of a captured workload is created, where the model comprises nodes that represent templates (which in turn correspond to requests) and edges that represent transitions between templates. The model is used to create an artificial workload, such as a workload that is twice as large as the originally-captured workload. The model may also be edited before creating the artificial workload. In another approach, workload models are compared to identify errors, regressions, or security issues. In another approach, an artificial workload is created for an application that is not yet deployed and then executed to determine whether the artificial workload or the originally-captured workload executed faster.

Applications of automated discovery of template patterns based on received requests

The present disclosure relates to identifying process flows from log sources (e.g., log files), and generating visual representations (e.g., flow diagrams, Sankey diagrams, etc.) of the identified process flows. In addition, the present disclosure relates to clustering of tree structures based on the shape of the tree structure using one or more hashing algorithms. The present disclosure also relates to a user interface that presents a query builder for efficiently querying a log analytics system for tree structures that satisfy a user-defined range.

Systems and methods for identifying process flows from log files and visualizing the flow

Techniques for implementing user interfaces, systems, and processes for multidimensional clustering and analysis are described herein. In one aspect, an application or cloud service receives a request to cluster a set of records where the request identifies a first set of one or more dimensions to use for clustering and a second set of one or more dimensions to analyze for correlation patterns. Responsive to receiving the request to cluster the set of records, the system generates clusters based at least in part on variances in the first set of one or more dimensions, wherein each cluster includes at least one record from the set of records. The system may generate, for each respective cluster, an analytic result that identifies how strongly the second set of one or more dimensions correlate to the respective cluster. The system may present the clusters and analytic results for further processing.

Multi-dimensional clustering and correlation with interactive user interface design

Disclosed is a system, method, and computer program product for analyzing sets of data in an efficient manner, such that analytics can be effectively performed over that data. Classification operations can be performed to generate groups of similar log records. This permits classification of the log records in a cohesive and informative manner.

Method and system for implementing efficient classification and exploration of data

A set of field values corresponding to a set of underlying fields are extracted from individual log messages. A space of potential values for underlying field(s) is identified. The space of potential values is segmented into value subspaces. Each value subspace is automatically associated with a category name. A definition for the new categorical field is generated, which indicates how a categorical value of the new categorical field depends on value(s) of the underlying field(s). For each log message, a categorical value is determined for the new categorical field based on the definition and the one or more values of the one or more underlying fields extracted from the log message. A presentation is generated that represents, for each log message, the particular category name corresponding to the categorical value determined for the log message.

Extracting and labeling custom information from log messages

The present disclosure relates to querying log messages stored at log endpoints (e.g., log cores) using query strings that reference virtual fields, and generating log field views presenting aggregate information for groups of log messages that are grouped based on criteria defined in the query string.

Querying distributed log data using virtual fields defined in query strings

Some embodiments relate to assigning individual log messages to clusters. An initial cluster assignment may be performed by applying a hash function to one or more non-variable components of the message to generate an initial cluster identifier. Subsequently, clustering may be further refined (e.g., by determining whether to merge clusters based on similarity values). An interface can present a representative message of each cluster and indicate which portions of the message correspond to a variable component. Particular inputs detected at the input corresponding to one of these components can cause other values for the component to be presented. For a given cluster, timestamps of assigned messages can be used to generate a time series, which can facilitate grouping of clusters (with similar or complementary shapes) and/or triggering alerts (with a condition corresponding to a temporal aspect).

Cluster-based processing of unstructured log messages

Growing community of inventors

San Mateo, CA, United States of America

Jae Young Yoon