Outlier and root cause determination of excessive resource usage in a virtual machine environment

A computer program product for identifying the root cause of outliers representing excess computing usage in a virtual machine system, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to:

• monitor resource usage data for a hypervisor;
• monitor resource usage data for a guest machine;
• identify outliers in the resource usage data for the hypervisor and outliers in the resource usage data for the guest machine, wherein the outliers represent excessive computing resource utilization by a server device hosting the hypervisor and the guest machine;
• execute a root cause model based on the resource usage data for the hypervisor and the resource usage data for the guest machine;
• generate a root cause report identifying results of the executed root cause model;
• and
• provide the root cause report for display.

A system comprising:

• a CPU, a computer readable memory and a computer readable storage medium associated with a computing device;
• program instructions to receive a first set of time series data pertaining to a hypervisor and a second set of time series data pertaining to a guest associated with the hypervisor;
• program instructions to determine a first set of outliers in the first set of time series data, and a second set of outliers in the second set of time series data,
• program instructions to determine a correlation between the first set of time series data and the second set of time series data to determine whether the first set of time series data and the second set of time series data include one or more contiguous time series points;
• program instructions to, on condition that the first set of time series data and the second set of time series data are determined to include one or more contiguous time series points, provide the first set of time series data, the second set of time series data, and the contiguous time series points as inputs to a directed acyclic graph to determine whether the outliers are a result of a spinning process or genuine workload;
• program instructions to, on condition that the first set of time series data and the second set of time series data are determined to not include any contiguous time series points, separately provide the first set of time series data as input to a first instance of the directed acyclic graph and provide the second set of time series data as input to a second instance of the directed acyclic graph to determine whether the outliers are a result of a spinning process or genuine workload;
• program instructions to generate a root cause report identifying results of the executed root cause model;
• and
• program instructions to provide the root cause report for display,
• wherein the program instructions are stored on the computer readable storage medium for execution by the CPU via the computer readable memory.