# US 11,113,174 B1 · Methods and systems that identify dimensions related to anomalies in system components of distributed computer systems using traces, metrics, and component-associated attribute values > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,174 B1 - Document ID: US11113174B1 - Status: Granted - Kind: B1 - Application number: 16/833,102 - Filed: 2020-03-27 - Published: 2021-09-30 - Granted: 2021-09-07 - Earliest claimed: 2020-03-27 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Dev Nag; Naira Movses Grigoryan; Arnak Poghosyan; Ashot Nshan Harutyunyan - Web page: https://patentgrep.com/patent/US11113174B1 ## CPC - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 11/0754: {by exceeding limits} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3034: {where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097)} - G06F 11/3065: {Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766)} - G06F 11/3075: {the data filtering being achieved in order to maintain consistency among the monitored data, e.g. ensuring that the monitored data belong to the same timeframe, to the same system or component} - G06F 2201/815: Virtual - G06F 2201/86: Event-based monitoring - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The current document is directed to methods and systems that employ distributed-computer-system metrics collected by one or more distributed-computer-system metrics-collection services, call traces collected by one or more call-trace services, and attribute values for distributed-computer-system components to identify attribute dimensions related to anomalous behavior of distributed-computer-system components. In a described implementation, nodes correspond to particular types of system components and node instances are individual components of the component type corresponding to a node. Node instances are associated with attribute values and node are associated with attribute-value spaces defined by attribute dimensions. Using attribute values and call traces, attribute dimensions that are likely related to particular anomalous behaviors of distributed-computer-system components are determined by decision-tree-related analyses and are reported to one or more computational entities to facilitate resolution of the anomalous behaviors. ## Claims ### Claim 1 A system that determines relevant attribute dimensions correlated with anomalous operational behaviors of components of a distributed computer system, the system comprising: one or more processors; one or more memories; and computer instructions, stored in one or more of the one or more memories that, when executed by one or more of the one or more processors, control the system to collect metric data comprising a series of timestamped metric values associated with each metric of multiple metrics, wherein each metric of the multiple metrics is associated with a component or component type of the distributed computer system, identify components of the distributed computer system which exhibit anomalous operational behaviors using the collected metric data, access collected call traces from a call-tracing service, access attribute values for selected components of the distributed computer system, employ decision-tree-based analyses to determine relevant attribute dimensions of component types that are correlated with the identified components of the distributed computer system which exhibit anomalous operational behaviors, and transmit the determined relevant attribute dimensions of the component types to a computational entity to facilitate amelioration of the anomalous operational behaviors. ### Claim 2 (depends on 1) The system of claim 1 wherein the selected components of the distributed computer system are selected from among: a distributed service-oriented application; service nodes of the distributed service-oriented application; service instances of the service nodes of the distributed service-oriented application; servers; mass-storage devices and appliances; and networking components. ### Claim 3 (depends on 1) The system of claim 1 wherein the collected call traces each encodes a series of component types related to execution of a requested task or service. ### Claim 4 (depends on 3) The system of claim 3 wherein the collected call traces each encodes a series of service calls to service nodes within a distributed service-oriented application related to a service call made by a remote client to the distributed service-oriented application. ### Claim 5 (depends on 1) The system of claim 1 wherein the attribute values for the selected components of the distributed computer system are points within an attribute-value space, for which attributes are dimensions, that is associated with component types of the selected components of the distributed computer system. ### Claim 6 (depends on 5) The system of claim 5 wherein the attribute values for the selected components of the distributed computer system are collected from one or more of an attribute-value store and call traces that include component types of the identified components of the distributed computer system which exhibit anomalous operational behaviors. ### Claim 7 (depends on 6) The system of claim 6 wherein the decision-tree-based analyses determine the relevant attribute dimensions of the component types in which the attribute values for the selected components of the distributed computer system are localized, rather than distributed across the relevant attribute dimensions of the component types. ### Claim 8 (depends on 7) The system of claim 7 wherein the decision-tree-based analyses determine attributes and attribute values that partition the collected call traces into a subset that contains call traces that include components of the distributed computer system, and only call traces that include components of the distributed computer system which exhibit anomalous operational behaviors, and one or more additional subsets. ### Claim 9 A method that determines relevant attribute dimensions correlated with anomalous operational behaviors of components of a distributed computer system, the method comprising: collecting metric data comprising a series of timestamped metric values associated with each metric of multiple metrics, wherein each metric of the multiple metrics is associated with a component or component type of the distributed computer system; identifying components of the distributed computer system which exhibit anomalous operational behaviors using the collected metric data; accessing collected call traces from a call-tracing service; accessing attribute values for selected components of the distributed computer system; employing decision-tree-based analyses to determine relevant attribute dimensions of component types that are correlated with the identified components of the distributed computer system which exhibit anomalous operational behaviors; and transmitting the determined relevant attribute dimensions of the component types to a computational entity to facilitate amelioration of the anomalous operational behaviors. ### Claim 10 (depends on 9) The method of claim 9 wherein the selected components of the distributed computer system are selected from among: a distributed service-oriented application; service nodes of the distributed service-oriented application; service instances of the service nodes of the distributed service-oriented application; servers; mass-storage devices and appliances; and networking components. ### Claim 11 (depends on 9) The method of claim 9 wherein the collected call traces each encodes a series of component types related to execution of a requested task or service. ### Claim 12 (depends on 11) The method of claim 11 wherein the collected call traces each encodes a series of service calls to service nodes within a distributed service-oriented application related to a service call made by a remote client to the distributed service-oriented application. ### Claim 13 (depends on 9) The method of claim 9 wherein the attribute values for the selected components of the distributed computer system are points within an attribute-value space, for which attributes are dimensions, that is associated with component types of the selected components of the distributed computer system. ### Claim 14 (depends on 9) The method of claim 9 wherein the attribute values for the selected components of the distributed computer system are collected from one or more of an attribute-value store and call traces that include component types of the identified components of the distributed computer system which exhibit anomalous operational behaviors. ### Claim 15 (depends on 14) The method of claim 14 wherein the decision-tree-based analyses determine the relevant attribute dimensions of the component types in which the attribute values for the selected components of the distributed computer system are localized, rather than distributed across the relevant attribute dimensions of the component types. ### Claim 16 (depends on 15) The method of claim 15 wherein the decision-tree-based analyses determine attributes and attribute values that partition the collected call traces into a subset that contains call traces that include components of the distributed computer system, and only call traces that include components of the distributed computer system which exhibit anomalous operational behaviors, and one or more additional subsets. ### Claim 17 A physical data-storage device that stores computer instructions that, when executed by one or more processors of a system that includes one or more memories and one or more mass-storage devices, controls the system to determine relevant attribute dimensions correlated with anomalous operational behaviors of components of a distributed computer system by: collecting metric data comprising a series of timestamped metric values associated with each metric of multiple metrics, wherein each metric of the multiple metrics is associated with a component or component type of the distributed computer system; identifying components of the distributed computer system which exhibit anomalous operational behaviors using the collected metric data; accessing collected call traces from a call-tracing service; accessing attribute values for selected components of the distributed computer system; employing decision-tree-based analyses to determine relevant attribute dimensions of component types that are correlated with the identified components of the distributed computer system which exhibit anomalous operational behaviors; and transmitting the determined relevant attribute dimensions of the component types to a computational entity to facilitate amelioration of the anomalous operational behaviors. ### Claim 18 (depends on 17) The physical data-storage device of claim 17 wherein the selected components of the distributed computer system are selected from among: a distributed service-oriented application; service nodes of the distributed service-oriented application; service instances of the service nodes of the distributed service-oriented application; servers; mass-storage devices and appliances; and networking components.