Early risk detection and management in a software-defined data center

A system, comprising:

• a plurality of log sources of a software-defined data center (SDDC);
• and
• a log management server of the SDDC that performs operations comprising:
• receive historical logs associated with each of the plurality of log sources;
• determine a plurality of keywords in the historical logs, wherein each keyword precedes, and is indicative of, a risk to the SDDC;
• determine a set of association rules based on the plurality of keywords, wherein each of the set of association rules relates a sequence of operations from the historical logs, including a portion of the plurality of keywords, to a particular risk to the SDDC;
• monitor logs associated with the plurality of log sources;
• determine a potential risk to the SDDC indicated by the logs based on the set of association rules;
• determine a solution to the potential risk;
• and
• execute a plurality of steps of the solution.

A method, comprising:

• receiving historical logs associated with each of a plurality of log sources of a software-defined data center (SDDC);
• determining a plurality of keywords in the historical logs, wherein each keyword precedes, and is indicative of, a risk to the SDDC;
• determining a set of association rules based on the plurality of keywords, wherein each of the set of association rules relates a sequence of operations from the historical logs, including a portion of the plurality of keywords, to a particular risk to the SDDC;
• monitoring logs associated with the plurality of log sources;
• determining a set of potential risks to the SDDC indicated by the logs based on the set of association rules;
• determining a subset of the set of potential risks that each exceed a probability threshold performing a search to determine a respective solution to each of the subset of potential risks;
• and
• executing one of the solutions.