# US 12,222,991 B2 · Anomaly database system for processing telemetry data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,222,991 B2 - Document ID: US12222991B2 - Status: Granted - Kind: B2 - Application number: 17/886,088 - Filed: 2022-08-11 - Published: 2022-12-01 - Granted: 2025-02-11 - Earliest claimed: 2020-10-12 - Assignees: Rubrik, Inc. - Applicants: Rubrik, Inc. - Inventors: Gurashish Singh Brar; Karan Jayesh Bavishi; Gurjeet S. Arora - Web page: https://patentgrep.com/patent/US12222991B2 ## CPC - G06F 16/906: Clustering; Classification - H04L 65/80: Responding to QoS - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/1451: {by selection of backup contents} - G06F 11/1453: {using de-duplication of the data} - G06F 11/1464: {for networked environments} - G06F 11/1471: involving logging of persistent data for recovery - G06F 11/2094: {Redundant storage or storage space (G06F11/2056 takes precedence)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3034: {where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097)} - G06F 11/3409: {for performance assessment} - G06F 11/3447: {Performance evaluation by modeling} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 16/182: Distributed file systems - G06F 16/188: Virtual file systems - G06F 16/2462: {Approximate or statistical queries} - G06F 16/2471: {Distributed queries} - G06F 16/90335: {Query processing} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - H04L 65/61: for supporting one-way streaming services, e.g. Internet radio - H04L 65/613: for the control of the source by the destination (control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637) - H04L 65/65: Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP] - G06F 2201/815: Virtual - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F 2201/88: Monitoring involving counting - H04L 65/4061: Push-to services, e.g. push-to-talk or push-to-video - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In some examples, an anomaly database system is provided for processing metrics in telemetry data. An example anomaly database system comprises a continuous data management (CDM) node, the CDM node including a metrics library for sending out system metrics in a sparse manner and a statistics relay for receiving streaming metrics from nodes in a node cluster, the node cluster including the CDM node, the statistics relay pushing the received metrics to a metrics collector. A sparse consumers module pulls metrics, from the metrics collector, pushed to the metrics collector by the statistics relay. ## Claims ### Claim 1 An apparatus, comprising: at least one processor; memory coupled to the at least one processor; and instructions stored in the memory and executable by the at least one processor to: store telemetry data at a plurality of nodes in a data management system, wherein the plurality of nodes are connected to each other via a network, and wherein the plurality of nodes store one or more snapshots of a computing object, the telemetry data comprising a plurality of data points that indicate performance information related to the data management system; receive a query at a first node of the plurality of nodes in the data management system, the query comprising a request to display at least a portion of the telemetry data via a user interface associated with the data management system, wherein some or all of the at least the portion of the telemetry data is stored at a second node of the plurality of nodes in the data management system and the second node is different from the first node; obtain, based at least in part on the query, a subset of the at least the portion of the telemetry data from the plurality of nodes by running a sparse algorithm on the at least the portion of the telemetry data, wherein the sparse algorithm includes, in the subset of the at least the portion of the telemetry data, data points that: are outside a standard deviation band of the at least the portion of the telemetry data, are different from one or more previous data points, or satisfy respective difference thresholds with respect to the one or more previous data points or one or more subsequent data points; and output, in response to the query, an indication of the subset of the at least the portion of the telemetry data for display via the user interface. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein, to obtain the subset of the at least the portion of the telemetry data, the instructions are executable by the at least one processor to cause the apparatus to: obtain a first portion of the subset of the at least the portion of the telemetry data from the first node of the plurality of nodes in the data management system; and obtain a second portion of the subset of the at least the portion of the telemetry data from the second node of the plurality of nodes in the data management system. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the instructions are further executable by the at least one processor to cause the apparatus to: transmit the some or all of the at least the portion of the telemetry data from the second node to the first node in response to the query. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein, to receive the query at the first node of the plurality of nodes in the data management system, the instructions are executable by the at least one processor to cause the apparatus to: receive, via the user interface, the request indicating to display telemetry data associated with a designated time range, wherein the subset of the at least the portion of the telemetry data comprises a subset of the plurality of data points that correspond to the designated time range. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein, the instructions are executable by the at least one processor to cause the apparatus to: determine that a variance of a data point with respect to a previous data point or a subsequent data point is above a threshold, wherein the at least the portion of the telemetry data comprises the previous data point, the data point, and the subsequent data point; and select the data point to include in the subset of the at least the portion of the telemetry data based at least in part on the determination. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the performance information comprises system failure information, resource utilization information, system activity information, or a combination thereof. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the instructions are executable by the at least one processor to cause the apparatus to: receive the query at the first node of the plurality of nodes in the data management system, wherein a first portion of the subset is obtained from the first node, and wherein a second portion of the subset is obtained from the second node of the plurality of nodes. ### Claim 8 A method, comprising: storing telemetry data at a plurality of nodes in a data management system, wherein the plurality of nodes are connected to each other via a network, and wherein the plurality of nodes store one or more snapshots of a computing object, the telemetry data comprising a plurality of data points that indicate performance information related to the data management system; receiving a query at a first node of the plurality of nodes in the data management system, the query comprising a request to display at least a portion of the telemetry data via a user interface associated with the data management system, wherein some or all of the at least the portion of the telemetry data is stored at a second node of the plurality of nodes in the data management system and the second node is different from the first node; obtaining, based at least in part on the query, a subset of the at least the portion of the telemetry data from the plurality of nodes by running a sparse algorithm on the at least the portion of the telemetry data, wherein the sparse algorithm includes, in the subset of the at least the portion of the telemetry data, data points that: are outside a standard deviation band of the at least the portion of the telemetry data, are different from one or more previous data points, or satisfy respective difference thresholds with respect to the one or more previous data points; and outputting, in response to the query, an indication of the subset of the at least the portion of the telemetry data for display via the user interface. ### Claim 9 (depends on 8) The method of claim 8, wherein obtaining the subset of the at least the portion of the telemetry data comprises: obtaining a first portion of the subset of the at least the portion of the telemetry data from the first node of the plurality of nodes in the data management system; and obtaining a second portion of the subset of the at least the portion of the telemetry data from the second node of the plurality of nodes in the data management system. ### Claim 10 (depends on 8) The method of claim 8, further comprising: transmitting the some or all of the at least the portion of the telemetry data from the second node to the first node in response to the query. ### Claim 11 (depends on 8) The method of claim 8, wherein receiving the query at the first node of the plurality of nodes in the data management system comprises: receiving, via the user interface, the request indicating to display telemetry data associated with a designated time range, wherein the subset of the at least the portion of the telemetry data comprises a subset of the plurality of data points that correspond to the designated time range. ### Claim 12 (depends on 8) The method of claim 8, further comprising: determining that a variance of a data point with respect to a previous data point or a subsequent data point is above a threshold, wherein the at least the portion of the telemetry data comprises the previous data point, the data point, and the subsequent data point; and selecting the data point to include in the subset of the at least the portion of the telemetry data based at least in part on the determination. ### Claim 13 (depends on 8) The method of claim 8, wherein the performance information comprises system failure information, resource utilization information, system activity information, or a combination thereof. ### Claim 14 A non-transitory computer-readable medium storing code, the code comprising instructions executable by at least one processor to: store telemetry data at a plurality of nodes in a data management system, wherein the plurality of nodes are connected to each other via a network, and wherein the plurality of nodes store one or more snapshots of a computing object, the telemetry data comprising a plurality of data points that indicate performance information related to the data management system; receive a query at a first node of the plurality of nodes in the data management system, the query comprising a request to display at least a portion of the telemetry data via a user interface associated with the data management system, wherein some or all of the at least the portion of the telemetry data is stored at a second node of the plurality of nodes in the data management system and the second node is different from the first node; obtain, based at least in part on the query, a subset of the at least the portion of the telemetry data from the plurality of nodes by running a sparse algorithm on the at least the portion of the telemetry data, wherein the sparse algorithm includes, in the subset of the at least the portion of the telemetry data, data points that: are outside a standard deviation band of the at least the portion of the telemetry data, are different from one or more previous data points, or satisfy respective difference thresholds with respect to the one or more previous data points; and output, in response to the query, an indication of the subset of the at least the portion of the telemetry data for display via the user interface. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein, to obtain the subset of the at least the portion of the telemetry data, the instructions are executable by the at least one processor to: obtain a first portion of the subset of the at least the portion of the telemetry data from the first node of the plurality of nodes in the data management system; and obtain a second portion of the subset of the at least the portion of the telemetry data from the second node of the plurality of nodes in the data management system. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the instructions are further executable by the at least one processor to: transmit the some or all of the at least the portion of the telemetry data from the second node to the first node in response to the query. ### Claim 17 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein, to receive the query at the first node of the plurality of nodes in the data management system, the instructions are executable by the at least one processor to: receive, via the user interface, the request indicating to display telemetry data associated with a designated time range, wherein the subset of the at least the portion of the telemetry data comprises a subset of the plurality of data points that correspond to the designated time range.