Vmware, Inc.

Pushkar Patil

Ritesh Ranjan Jha

Nikhil Jaiswal

Jobin Raju George

Vaidic Joshi

Shivam Satija

Soumya Panigrahi

Suchit Dhakate

The current document is directed to methods and systems that automatically identify log/event-message traces and computational-entity transactions within collections and/or streams of log/event messages. Automated identification of log/event-message traces provides the basis for automated interpretation, by automated computer-system administration-and-the management subsystems, of the information represented by collections and/or streams of log/event messages. Disclosed approaches to automatically identifying log/event-message traces and computational-entity involve identifying log/event-message types, generating time-series-like log/event-message-type occurrence signals from log/event-message collections and/or streams, and computing cross correlations between pairs of log/event-message-type occurrence signals. In one implementation, a strongly-correlated-type graph is generated from the computed cross correlations, from which connected-components subgraphs, corresponding to computational-entity transactions, are extracted. Log/event-message traces are then extracted from acyclic graphs generated from the connected-component subgraphs.

Methods and systems that identify computational-entity transactions and corresponding log/event-message traces from streams and/or collections of log/event messages

The current document is directed to methods and systems that efficiently process and store log/event messages generated within distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system or a message-ingestion-and-processing subsystem. The currently disclosed methods and systems employ additional pre-processing steps to identify the types of received log/event messages, monitor event-type-associated log/event-message-usage-delay histories, and employ time-series-analysis-based and/or neural-network-based estimation of event-type-associated log/event-message usage to efficiently store log/event-messages in low-cost and low-latency storage facilities.

Method and subsystem within a distributed log-analytics system that automatically determines and enforces log-retention periods for received log-event messages

The current document is directed to methods and systems that efficiently process log/event messages within and among distributed computer facilities. Various different types of initial processing steps may be applied to a stream of log/event messages received by a message-collector system or a message-ingestion-and-processing system. By including a pre-processing step two identify the type of a received log/event message, and by specifying initial-processing-step criteria with respect to log/event-message types, significant increases in the efficiency of log/event-message preprocessing by message-collector systems and message-ingestion-and-processing systems is achieved.

Efficient event-type-based log/event-message processing in a distributed log-analytics system

The current document is directed to methods and systems that sample log/event messages for downstream processing by log/event-message systems incorporated within distributed computer facilities. The data-collection, data-storage, and data-querying functionalities of log/event-message systems provide a basis for distributed log-analytics systems which, in turn, provide a basis for automated and semi-automated system-administration-and-management systems. By sampling log/event-messages, rather than processing and storing every log/event-message generated within a distributed computer system, a log/event-message system significantly decreases data-storage-capacity, computational-bandwidth, and networking-bandwidth overheads involved in processing and retaining large numbers of log/event messages that do not provide sufficient useful information to justify these costs. Increase in efficiencies of log/event-message systems obtained by sampling translate directly into increases in bandwidths of distributed computer systems, in general, and to increases in time periods during which useful log/event messages can be stored.

Methods and systems that sample log/event messages in a distributed log-analytics system

The current document is directed to methods and systems that efficiently cache log/event messages in log/event-message systems incorporated within distributed computer facilities. The log/event-message systems provide the data-collection, data-storage, and data-querying functionalities that provide a basis for distributed log-analytics systems which, in turn, provide a basis for automated and semi-automated system-administration-and-management systems. Efficient caching significantly extends the period of time that networking failures and log/event-message processing delays can be tolerated by log/event-message systems without significant loss of information. Rather than caching individual log/event messages, message collectors that employ the currently disclosed technologies cache information regarding log/event-message types, leading to efficient compression of the cached information. As a result, message collectors can cache log/event messages without significant loss of information for time periods of several orders of magnitude greater than those achieved by caching individual log/event messages.

Methods and systems that efficiently cache log/event messages in a distributed log-analytics system

System and computer-implemented method for constructing a topology for an application distributed over multiple virtual computing instances in which a set of resource utilization metrics are collected for multiple computing instances. A propagation sequence caused by an execution of the application is determined based on the set of resource utilization metrics. A graph may be created with the propagation sequence, wherein each virtual computing instance in the multiple computing instances is a possible node in the graph and the graph includes all nodes associated with the application.

Growing community of inventors

Bengaluru, India

Pushkar Patil