Citrix Systems, Inc.

Nikolaos Georgakopoulos

Manikam Muthiah

Satyendra Tiwari

Andreas Varnavas

Rahul Kumar

Utkarsh Agarwal

Srinivas Reddy Kasu

Pavan Belani

Systems and methods of reconstructing execution call flows to detect anomalies are provided. A device can establish call flows using information extracted from a log file. Each of the call flows can identify information from the log file of a call flowing through a plurality of modules. The device can identify a count of a number of occurrences of one or more keywords in information of each call flow. The device can generate a vector of numbers for each call flow based at least on the count for the one or more keywords for that call flow. The device can classify each call flow into one or more clusters that indicate whether an operation of the call flow is anomalous. The device can classify each call flow using the vector of numbers for each call flow.

Reconstructing execution call flows to detect anomalies

Described embodiments provide systems and methods for determining a change in a performance of a server. A device can receive a processing load and a request rate of a server. The device can determine a value indicative of a correlation between the processing load and the request rate of the server for a range of time. The device can determine whether the value is outside a range of a threshold for the server. The threshold can be indicative of one or more previous values determined for the server for the range of time. The device can generate an alert indicating a change in a performance of the server responsive to a comparison of the value to the threshold for the server.

Determining changes in a performance of a server

Described embodiments provide systems and methods for monitoring server utilization and reallocating resources using upper bound values. A device can determine a value indicative of an upper bound of a processing load of a server using data points detected for the processing load over a first range of time. The upper bound can correspond to a percentage of the processing load during the first range of time. The device can monitor, using the value, the processing load of the server over a second range of time. A determination can be made whether the value of the processing load is greater than a threshold during the second range of time. The device can generate an alert for the device responsive to a comparison of the value of the processing load to the threshold.

Determining server utilization using upper bound values

Growing community of inventors

Patras, Greece

Nikolaos Georgakopoulos