Predictive diagnosis of SLA violations in cloud services by seasonal trending and forecasting with thread intensity analytics

A non-transitory computer-readable storage memory storing instructions when, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving a plurality of thread dump samples, each thread dump sample corresponding to a different time during an execution of a computing process, wherein each particular thread dump sample within the plurality of thread dump samples includes one or more stack traces corresponding to one or more threads, and wherein each of the one or more stack traces includes one or more stack frames;
• identifying a first stack segment corresponding to a first set of stack frames within each of the plurality of thread dump samples;
• calculating a first plurality of intensity values for the first stack segment, wherein each of the plurality of intensity values for the first stack segment corresponds to an intensity of a particular stack frame in the first set of stack frames;
• determining a stack segment classification for the first stack segment, based on the first plurality of intensity values calculated for the first stack segment;
• determining a plurality of stack frame subsets within the first set of stack frames corresponding to the first stack segment, each of the stack frame subsets having one or more constituent stack frames;
• for each particular stack frame subset of the plurality of stack frame subsets, calculating a plurality of intensity values, wherein each of the plurality of intensity values for the particular stack frame subset corresponds to an intensity of a particular constituent stack frame of the particular stack frame subset;
• analyzing the intensity values calculated for each of the plurality of stack frame subsets within the first set of stack segments, said analysis including determining whether the intensity values of the plurality of stack frame subsets are diverging over time beyond a threshold;
• in response to determining that the intensity values of the plurality of stack frame subsets are diverging over time, generating a plurality of new stack segments corresponding to the plurality of stack frame subsets, wherein each of the plurality of new stack segments is generated as a new constituent stack segment of the first stack segment;
• determining one or more intensity trends for one or more of the new constituent stack segments of the first stack segment;
• detecting an anomaly within the execution of the computing process, based on the one or more determined intensity trends for the constituent stack segments;
• and
• outputting an indication of the anomaly within the execution of the computing process, based on the detection of the anomaly.

A system comprising:

• one or more network interfaces configured to receive thread dump samples corresponding to one or more virtual machines;
• a processing unit comprising one or more processors;
• and
• a non-transitory memory communicatively coupled with and readable by the processing unit and comprising a sequence of instructions which, when executed by the one or more processors, causes the system to:
• receive a plurality of thread dump samples corresponding to an execution of a first Java Virtual Machine (JVM), each thread dump sample corresponding to a different time during the execution of the JVM, wherein each particular thread dump sample within the plurality of thread dump samples includes one or more stack traces corresponding to one or more threads, and wherein each of the one or more stack traces includes one or more stack frames;
• identify a first stack segment corresponding to a first set of stack frames within each of the plurality of thread dump samples;
• calculate a first plurality of intensity values for the first stack segment, wherein each of the plurality of intensity values for the first stack segment corresponds to an intensity of a particular stack frame in the first set of stack frames;
• determining a stack segment classification for the first stack segment, based on the first plurality of intensity values calculated for the first stack segment;
• determine a plurality of stack frame subsets within the first set of stack frames corresponding to the first stack segment, each of the stack frame subsets having one or more constituent stack frames;
• for each particular stack frame subset of the plurality of stack frame subsets, calculating a plurality of intensity values, wherein each of the plurality of intensity values for the particular stack frame subset corresponds to an intensity of a particular constituent stack frame of the particular stack frame subset;
• analyzing the intensity values calculated for each of the plurality of stack frame subsets within the first set of stack segments, said analysis including determining whether the intensity values of the plurality of stack frame subsets are diverging over time beyond a threshold;
• in response to determining that the intensity values of the plurality of stack frame subsets are diverging over time, generating a plurality of new stack segments corresponding to the plurality of stack frame subsets, wherein each of the plurality of new stack segments is generated as a new constituent stack segment of the first stack segment;
• determining one or more intensity trends for one or more of the new constituent stack segments of the first stack segment;
• detecting an anomaly within the execution of the JVM, based on the one or more determined intensity trends for the constituent stack segments;
• and
• outputting an indication of the anomaly within the execution of the JVM, based on the detection of the anomaly.