Vmware, Inc.

Keshav Mathur

Darren Brown

Junyuan Lin

Paul Pedersen

Peng Gao

Leah Nutman

Xing Wang

Jinyi Lu

Rachil Chandran

Lalit Jain

James Ang

Nicholas Kushmerick

Harutyun Beybutyan

Kien Chiew Wong

Computational methods and systems to detect anomalous behaving resources and objects of a distributed computing system are described. Multiple streams of metric data representing usage of various resources of the distributed computing system are sent to a management system of the distributed computing system. The management system updates a performance model based on newly received metric values of the streams of metric data. The updated performance model is used to detect changes in one or more of the streams of metric data. The changes may be an indication of anomalous behavior at resources and objects associated with the streams of metric data. An anomaly listener is notified of anomalous behavior by the resource or object when a change in one or more of the streams of metric data is detected.

Streaming anomaly detection

Various examples are disclosed for transitioning usage forecasting in a computing environment. Usage of computing resources of a computing environment are forecasted using a first forecasting data model and usage measurements obtained from the computing resources. A use of the first forecasting data model in forecasting the usage is transitioned to a second forecasting data model without incurring downtime in the computing environment. After the transition, the usage of the computing resources of the computing environment is forecasted using the second forecasting data model and the usage measurements obtained from the computing resources. The second forecasting data model exponentially decays the usage measurements based on a respective time period at which the usage measurements were obtained.

Exponential decay real-time capacity planning

Computational methods and systems for detecting and troubleshooting anomalous behavior in distributed applications executing in a distributed computing system are described herein. Methods and systems discover nodes comprising the application. Anomaly detection monitors the metrics associated with the nodes for anomalous behavior in order to identify an approximate point in time when anomalous behavior begins to adversely impact performance of the application. Anomaly detection also monitors logs messages associated with the nodes to detect anomalous behavior recorded in the log messages. When anomalous behavior is detected in either the metrics and/or the log messages an alert identifying the anomalous behavior is generated. Troubleshooting guides an administrator and/or application owner to investigate the root cause of the anomalous behavior. Appropriate remedial measures may be determined based on the root cause and automatically or manually executed to correct the problem.

Methods and systems for troubleshooting applications using streaming anomaly detection

Computational methods and systems that estimate time remaining and right size for usable capacities of resources used to run virtual objects of a distributed computing system are described. For each stream of metric data that represents usage of a resource of a distributed computing system, a model for forecasting metric data is determined and used to compute forecasted metric data in a forecast interval. A resource utilization metric is computed from the forecasted metric data and may be used to estimate a time remaining before the usable capacity of the resource is expected to be insufficient and the resource usable capacity is adjusted. The resource utilization metric may be used to determine the capacity remaining is insufficient. A right-size usable capacity for the resource is computed based on the resource utilization metric and the usable capacity of the resource is adjusted to at least the right-size usable capacity.

Methods and systems for estimating time remaining and right sizing usable capacities of resources of a distributed computing system

Computational methods and systems to reclaim capacity of a virtual infrastructure of distributed computing system are described. Methods and systems are directed to forecasting usage of resources that form a virtual infrastructure of a distributed computing system. Streams of metric data that represent usage of resources of the virtual infrastructure assigned to a virtual object are collected. A binary sequence of active status metric data is computed for the virtual object based on the streams of metric data. Forecasted active status metric data are computed in a forecast interval based on the sequence of active status metric data. Expected active or inactive status of virtual object over the forecast interval is determined from the forecasted active status metric data. If the virtual object is expected to inactive status over the forecast interval, resources assigned to the virtual object are reclaimed for use by active virtual objects.

Methods and systems to reclaim capacity of unused resources of a distributed computing system

Various examples are disclosed for forecasting resource usage and computing capacity utilizing an exponential decay. In some examples, a computing environment can obtain usage measurements from a data stream over a time interval, where the usage measurements describe utilization of computing resource. The computing environment can generate a weight function for individual ones of the usage measurements, where the weight function exponentially decays the usage measurements based on a respective time period at which the usage measurements were obtained. The computing environment can forecast a future capacity of the computing resources based on the usage measurements and the weight function assigned to the individual ones of the usage measurements. The computing environment can further upgrade a forecast engine to use the exponential decay without resetting the forecast engine or its memory.

Computational methods and systems that proactively manage usage of computational resources of a distributed computing system are described. A sequence of metric data representing usage of a resource is detrended to obtain a sequence of non-trendy metric data. Stochastic process models, a pulse wave model and a seasonal model of the sequence of non-trendy metric data are computed. When a forecast request is received, a sequence of forecasted metric data is computed over a forecast interval based on the estimated trend and one of the pulse wave or seasonal model that matches the periodicity of the sequence of non-trendy metric data. Alternatively, the sequence of forecasted metric data is computed based on the estimated trend and the stochastic process model with a smallest accumulated residual error. Usage of the resource by virtual objects of the distributed computing system may be adjusted based on the sequence of forecasted metric data.

Growing community of inventors

Palo Alto, CA, United States of America

Keshav Mathur