# US 2014/0195465 A1 · Monitor-mine-manage cycle > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195465 A1 - Document ID: US20140195465A1 - Status: Published application - Kind: A1 - Application number: 13/734,961 - Filed: 2013-01-05 - Published: 2014-07-10 - Earliest claimed: 2013-01-05 - Assignees: Microsoft Corporation - Applicants: Microsoft Corporation - Inventors: Panos Periorellis; Eldar Akchurin; Joris Claessens; Ivo Jose Garcia dos Santos; Olivier Nano - Web page: https://patentgrep.com/patent/US20140195465A1 ## CPC - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3082: {the data filtering being achieved by aggregating or compressing the monitored data} - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - G06F 2201/86: Event-based monitoring - G06N 5/02: Knowledge representation; Symbolic representation - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A monitor-mine-manage cycle is described, for example, for managing a data center, a manufacturing process, an engineering process or other processes. In various example, the following steps are performed as a continuous automated loop: receiving raw events from an observed system; monitoring the raw events and transforming them into complex events; mining the complex events and reasoning on results; making a set of proposed actions based on the mining; and managing the observed system by applying one or more of the proposed actions to the system. In various examples, the continuous automated loop proceeds while raw events are continuously received from the observed system and monitored. In some examples an application programming interface is described comprising programming statements which allow a user to implement a monitor-mine-manage loop. ## Claims ### Claim 1 A computer-implemented method, wherein the following steps are performed as a continuous automated loop: receiving raw events from an observed system; monitoring the raw events and transforming them into complex events; mining the complex events and reasoning on results; making a set of proposed actions based on the mining; and managing the observed system by applying the proposed actions to the system, while raw events are continuously received from the observed system and monitored. ### Claim 2 (depends on 1) The method of claim 1, wherein the steps of monitoring, mining and managing are performed in real-time or near real-time and an input to a step is based on output of a previous step with little or no time delay. ### Claim 3 (depends on 1) The method of claim 1, wherein the raw events are received as streams and the transformation from raw events into complex events is performed by event stream processing technology. ### Claim 4 (depends on 1) The method of claim 1, wherein the transformation from raw events into complex events comprises aggregation and processing of the raw events. ### Claim 5 (depends on 1) The method of claim 1, wherein the mining comprises performing at least one of statistical analysis, pattern recognition and machine learning. ### Claim 6 (depends on 1) The method of claim 1, wherein the raw events are the changes of the length of a queue of user requests and the mining comprises using a Bayesian model for estimating a length of the queue. ### Claim 7 (depends on 6) The method of claim 6, wherein the mining further comprises receiving a service level agreement and comprises predicting whether the service level agreement will be fulfilled. ### Claim 8 (depends on 1) The method of claim 1, wherein the proposed actions based on the mining are represented as a stream. ### Claim 9 (depends on 1) The method of claim 1, wherein the managing comprises performing repairs, updates, backups and configurations on the observed system. ### Claim 10 (depends on 7) The method of claim 7, wherein the managing comprises deploying and removing a server from a set of servers which serve the user requests. ### Claim 11 (depends on 1) The method of claim 1, wherein the managing is based on static constraints. ### Claim 12 (depends on 11) The method of claim 11, wherein the static constraints are costs involved with the proposed actions to be performed. ### Claim 13 (depends on 11) The method of claim 11, wherein the static constraints are at least one of the maximum number of servers deployed, the maximum number of electricity spent per day, the maximum number of cash spent to have the servers deployed. ### Claim 14 (depends on 1) The method of claim 1, wherein a streaming engine is located on the observed system and a streaming client is located on a monitoring system. ### Claim 15 (depends on 1) The method of claim 1, wherein the method is used to make the observed system a self-healing system. ### Claim 16 A monitor-mine-manage engine comprising: a communications interface arranged to receiving raw events from an observed system; a processor arranged to monitor the raw events by transforming them into complex events; the processor being arranged to mine the complex events and reasoning on results; the processor being arranged to make a set of proposed actions based on the mining, and to manage the observed system by applying the proposed actions to the system, while raw events are continuously received from the observed system and monitored wherein the engine is arranged to carry out the steps of monitoring, mining and managing in real-time or near real-time and an input to a step is based on output of a previous step with little or no time delay. ### Claim 17 (depends on 16) A monitor-mine-manage engine as claimed in claim 16 at least partially implemented using hardware logic selected from any one or more of: a field-programmable gate array, a program-specific integrated circuit, a program-specific standard product, a system-on-a-chip, a complex programmable logic device. ### Claim 18 An application programming interface comprising programming statements which allow a user to implement a monitor-mine-manage loop, the application programming interface comprising the following entities: a data source entity which enables the user to express a source of monitoring data to be observed; a feature extraction entity which allows a user to express a set of features to be extracted from the raw data; a model application entity which allows a user to apply a model to the complex events created from the feature extraction; and an actions entity which allows a user to describe management operations on the observed infrastructure. ### Claim 19 (depends on 18) The application programming interface of claim 18, wherein the programming statements are declarative constructs. ### Claim 20 (depends on 18) The application programming interface of claim 18, comprising a monitoring statement which takes as input a type of the component it monitors.