# US 12,007,830 B2 · Methods and systems for resolving performance problems with objects of a data center

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,007,830 B2
- Document ID: US12007830B2
- Status: Granted
- Kind: B2
- Application number: 17/871,080
- Filed: 2022-07-22
- Published: 2024-01-25
- Granted: 2024-06-11
- Earliest claimed: 2022-07-22
- Assignees: VMware, Inc.
- Applicants: VMware LLC
- Inventors: Ashot Nshan Harutyunyan; Arnak Poghosyan; Lilit Harutyunyan; Nelli Aghajanyan; Tigran Bunarjyan; Marine Harutyunyan; Sam Israelyan
- Web page: https://patentgrep.com/patent/US12007830B2

## CPC

- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/3409: {for performance assessment}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0769: {Readable error formats, e.g. cross-platform generic formats, human understandable formats}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/3447: {Performance evaluation by modeling}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 2201/86: Event-based monitoring
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Automated, computer-implemented methods and systems for resolving performance problems with objects executing in a data center are described. The automated methods use machine learning to train a model that comprises rules defining relationships between probabilities of event types of in log messages and values of a key performance indictor (“KPI”) of the object over a historical time period. When a KPI violates a corresponding threshold, the rules are used to evaluate run time log messages that describe the probable root cause of the performance problem. An alert identifying the KPI threshold violation, and the log messages are displayed in a graphical user interface of an electronic display device.

## Claims

### Claim 1

A method, stored in one or more data-storage devices and executed using one or more processors of a computer system, for resolving probable root causes of performance problems with an object executing in a data center, the method comprising:
using machine learning to train a model that comprises rules defining relationships between probabilities of event types of log messages and values of a key performance indicator (“KPI”) of the object over a historical time period;
in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval;
using the rules to evaluate the probabilities of event types of the log messages recorded in the run-time interval for important event types;
identifying log messages with the important event types generated in the run-time interval;
displaying an alert identifying the KPI threshold violation and the log messages in a graphical user interface of an electronic display device, the log messages describing the probable root cause of the performance problem; and
executing remedial measures to correct the performance problem, the remedial measures including spinning up one or more clones of the object on one or more server computers and migrating the object to a server computer to optimize use of data center resources.

### Claim 2 (depends on 1)

The method of claim 1 wherein using machine learning to train the model comprises:
for each KPI in a historical time period repeat operations comprising:
tagging KPI values that violate a KPI threshold with a first tag;
tagging KPI values that do not violate the KPI threshold with second tag;
identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;
extracting event types of the log messages with time stamps in the time interval
computing event type probabilities of the extracted event types: and
forming a probability distribution from the event type probabilities.

### Claim 3 (depends on 2)

The method of claim 2 further comprising:
detecting important event types of the probability distributions using random forests based on the probability distributions and the corresponding tags of the KPI values;
reducing the probability distributions to important event type probabilities that correspond to the important event types; and
using machine learning to train a decision-tree model that comprises rules defining relationships between the important event types and the KPI values.

### Claim 4 (depends on 1)

The method of claim 1 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:
identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPI threshold;
extracting event types of the log messages; and
computing run-time event type probabilities of the extracted event types in the run-time interval.

### Claim 5 (depends on 1)

The method of claim 1 wherein using the rules to evaluate the event type probabilities for important event types comprises:
identifying important run-time event type probabilities in the run-time event type probabilities based on important event types; and
for each of the rules of the model repeat operations comprising:
comparing the important run-time even type distributions to the conditional statements of the rule, and
in response to the conditional statements being satisfied, identifying the important event types of the important event type probabilities that satisfy the conditional statements of the rule.

### Claim 6

A computer system for resolving probable root causes of performance problems with an object executing in a data center, the computer system comprising:
one or more processors;
one or more data-storage devices; and
machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors control the system to perform operations comprising:
using machine learning to train a model that comprises rules defining relationships between probabilities of event types of log messages and values of a key performance indicator (′KPI″) of the object over a historical time period;
in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval;
using the rules to evaluate the probabilities of event types of the log messages recorded in the run-time interval for important event types;
identifying log messages with the important event types generated in the run-time interval;
displaying an alert identifying the KPI threshold violation and the log messages in a graphical user interface of an electronic display device, the log messages describing the probable root cause of the performance problem; and
executing remedial measures to correct the performance problem, the remedial measures including spinning up one or more clones of the object on one or more server computers and migrating the object to a server computer to optimize use of data center resources.

### Claim 7 (depends on 6)

The system of claim 6 wherein using machine learning to train the model comprises:
for each KPI in a historical time period repeat operations comprising:
tagging KPI values that violate a KPI threshold with a first tag;
tagging KPI values that do not violate the KPI threshold with second tag;
identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;
extracting event types of the log messages with time stamps in the time interval;
computing event type probabilities of the extracted event types; and
forming a probability distribution from the event type probabilities.

### Claim 8 (depends on 7)

The system of claim 7 further comprising:
detecting important event types of the probability distributions using random forests based on the probability distributions and the corresponding tags of the KPI values;
reducing the probability distributions to important event type probabilities that correspond to the important event types; and
using machine learning to train a decision-tree model that comprises rules defining relationships between the important event types and the KPI values.

### Claim 9 (depends on 6)

The system of claim 6 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:
identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPI threshold;
extracting event types of the log messages; and
computing run-time event type probabilities of the extracted event types in the run-time interval.

### Claim 10 (depends on 6)

The system of claim 6 wherein using the rules to evaluate the event type probabilities for important event types comprises:
identifying important run-time event type probabilities in the run-time event type probabilities based on important event types; and
for each of the rules of the model repeat operations comprising:
comparing the important run-time even type distributions to the conditional statements of the rule, and
in response to the conditional statements being satisfied, identifying the important event types of the important event type probabilities that satisfy the conditional statements of the rule.

### Claim 11

A non-transitory computer-readable medium having instructions encoded thereon for enabling one or more processors of a computer system to perform operations comprising:
using machine learning to train a model that comprises rules defining relationships between probabilities of event types of log messages and values of a key performance indicator (“KPI”) of an object of a data center over a historical time period:
in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval;
using the rules to evaluate the probabilities of event types of the log messages recorded in the run-time interval for important event types;
identifying log messages with the important event types generated in the run-time interval;
displaying an alert identifying the KPI threshold violation and the log messages in a graphical user interface of an electronic display device, the log messages describing the probable root cause of the performance problem; and
executing remedial measures to correct the performance problem, the remedial measures including spinning up one or more clones of the object on one or more server computers and migrating the object to a server computer to optimize use of data center resources.

### Claim 12 (depends on 11)

The medium of claim 11 wherein using machine learning to train the model comprises:
for each KPI in a historical time period repeat operations comprising:
tagging KPI values that violate a KPI threshold with a first tag;
tagging KPI values that do not violate the KPI threshold with second tag;
identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;
extracting event types of the log messages with time stamps in the time interval;
computing event type probabilities of the extracted event types; and
forming a probability distribution from the event type probabilities.

### Claim 13 (depends on 12)

The medium of claim 12 further comprising
detecting important event types of the probability distributions using random forests based on the probability distributions and the corresponding tags of the KPI values;
reducing the probability distributions to important event type probabilities that correspond to the important event types; and
using machine learning to train a decision-tree model that comprises rules defining relationships between the important event types and the KPI values.

### Claim 14 (depends on 11)

The medium of claim 11 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:
identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPI threshold;
extracting event types of the log messages; and
computing run-time event type probabilities of the extracted event types in the run-time interval.

### Claim 15 (depends on 11)

The medium of claim 11 wherein using the rules to evaluate the event type probabilities for important event types comprises:
identifying important run-time event type probabilities in the run-time event type probabilities based on important event types; and
for each of the rules of the model repeat operations comprising:
comparing the important run-time even type distributions to the conditional statements of the rule, and
in response to the conditional statements being satisfied, identifying the important event types of the important event type probabilities that satisfy the conditional statements of the rule.