Method and system for real-time identification of blast radius of a fault in a globally distributed virtual desktop fabric

A method for mitigating a blast radius of a major incident in a virtual remote desktop system providing virtual desktops to client devices, the virtual remote desktop system having network interconnected service components including servers executing a virtual machine to execute the virtual desktops and the client devices, individual cloud desktops or application servers, and a network gateway allowing access to a network, the method comprising:

• collecting events data of service components via the network, the events data generated electronically from all service components traced to a fault including the servers and the client devices;
• merging the collected events data in a time-ordered event stream via a processor;
• correlating the collected events data in the time-ordered event stream to show relationships across events data to create a correlated event stream;
• determining a stream of problem reports from the correlated event stream;
• determine a spike in the stream of problem reports via the processor;
• determining the attributes of the problem reports in the spike to define the major incident via the processor;
• determining a scope of the major incident and a corresponding attribute to determine the blast radius associated with the major incident in the virtual remote desktop system via the processor;
• and
• sending a command to at least some of service components in the blast radius to perform a mitigating action, wherein the mitigating action includes at least one of upgrading one of the cloud desktops or application servers, or changing the capability of the network gateway.

A diagnostic system for determining a blast radius from a major incident in a virtual remote desktop system providing access to virtual desktops by client devices, the virtual remote desktop system having network interconnected service components including servers executing a virtual machine to execute the virtual desktops and the client devices, the diagnostic system comprising:

• an event collection module coupled to the service components of the desktop system, the event collection module collecting events data via the network, the events data generated electronically from the service components including the servers and the client devices;
• an aggregation module coupled to the event collection module, the aggregation module executed by a processor, the aggregation module merging the collected events data in a time-ordered stream, providing context to the events data in the time-ordered stream through relationships between the collected events data, and generating a correlated event stream;
• and
• an analysis module executed by a processor configured to:
• determine a stream of problem reports from the correlated event stream;
• determine a spike in the stream of problem reports;
• determine the attributes of the problem reports in the spike to define the major incident;
• determine a scope of the major incident and a corresponding attribute to determine a blast radius composed of all service components associated with the major incident;
• and
• send a command over the network to one or more of the service components in the blast radius to execute a mitigating action, wherein the mitigating action includes at least one of reconfiguration to redirect end users to a virtualization infrastructure of service components outside of the blast radius;
• updating a network configuration;
• updating configurations of a cloud service provider configurations, updating an authentication service configuration, updating an authorization service configuration, or updating a security provider service configuration.