Darren G Brown, 59Spring Glen, WA

2021038, Dec 9, 2021

Jul 22, 2021

17/382676

- Palo Alto CA, US
Darren Brown - Seattle WA, US
Ashok Kumar - Palo Alto CA, US

VMware, Inc. - Palo Alto CA

G06F 9/455
G06K 9/62

Computer-implemented methods and systems described herein are directed to reducing volumes of log messages sent from edge systems to a data center. The computer-implemented methods performed at each edge system includes collecting a stream of log messages generated by one or more event sources of the edge system. Representative log messages of the stream of log messages are determined. The edge systems may discard non-representative log messages from data storage devices at the edge system. The representative log messages are sent from each of the edge systems to the data center where the representative log messages are received and stored in data storage devices of the data center, thereby reducing the volumes of log messages sent from the edge systems to the data center.

2021038, Dec 9, 2021

Jun 5, 2020

16/893778

- Palo Alto CA, US
Xing Wang - Palo Alto CA, US
Shafi Khan - Palo Alto CA, US
Apolak Borthakur - Palo Alto CA, US
Paul Pedersen - Palo Alto CA, US
Darren Brown - Seattle WA, US
Gopal Harikumar - Palo Alto CA, US

VMware, Inc. - Palo Alto CA

G06F 11/07
G06F 11/30
G06K 9/62
G06K 9/68

Automated methods and systems described herein are directed to identifying potential root causes of a problem in a data center. Methods and systems receipt an alert or other notification of a problem occurring in a data center and a time when the problem was noticed. A search window is created based on the time and a stream of log messages generated in the search window is converted into a time dependent metric. An anomaly detection technique is applied to the metric to determine a start time of a problem. Logging events and key phrases in the log messages are identified in the search window and presented as potential root causes of the problem. The potential root cause may then be used by system administrators and/or tenants to diagnose the problem and execute remedial measures to correct the problem.

2021027, Sep 2, 2021

May 20, 2021

17/325602

- Palo Alto CA, US
Jinyi Lu - Mountain View CA, US
Paul Pedersen - Palo Alto CA, US
Junyuan Lin - Seattle CA, US
Darren Brown - Seattle WA, US
Peng Gao - Palo Alto CA, US
Leah Nutman - Sunnyvale CA, US
Xing Wang - Palo Alto CA, US

G06F 11/34
G06F 9/50
G06N 5/04
G06F 11/30

Various examples are disclosed for transitioning usage forecasting in a computing environment. Usage of computing resources of a computing environment are forecasted using a first forecasting data model and usage measurements obtained from the computing resources. A use of the first forecasting data model in forecasting the usage is transitioned to a second forecasting data model without incurring downtime in the computing environment. After the transition, the usage of the computing resources of the computing environment is forecasted using the second forecasting data model and the usage measurements obtained from the computing resources. The second forecasting data model exponentially decays the usage measurements based on a respective time period at which the usage measurements were obtained.

2021014, May 13, 2021

Nov 13, 2019

16/682255

- Palo Alto CA, US
Jinyi Lu - Palo Alto CA, US
Xing Wang - Palo Alto CA, US
Darren Brown - Seattle WA, US
Peng Gao - Palo Alto CA, US
Junyuan Lin - Bellevue WA, US
Paul Pedersen - Palo Alto WA, US

VMware, Inc. - Palo Alto CA

H04L 29/06
H04L 12/26
H04L 12/24
H04L 29/08

Computational methods and systems to detect anomalous behaving resources and objects of a distributed computing system are described. Multiple streams of metric data representing usage of various resources of the distributed computing system are sent to a management system of the distributed computing system. The management system updates a performance model based on newly received metric values of the streams of metric data. The updated performance model is used to detect changes in one or more of the streams of metric data. The changes may be an indication of anomalous behavior at resources and objects associated with the streams of metric data. An anomaly listener is notified of anomalous behavior by the resource or object when a change in one or more of the streams of metric data is detected.

2020037, Nov 26, 2020

May 22, 2019

16/419174

- Palo Alto CA, US
Jinyi Lu - Mountain View CA, US
Paul Pedersen - Palo Alto CA, US
Junyuan Lin - Seattle CA, US
Darren Brown - Seattle WA, US
Peng Gao - Palo Alto CA, US
Leah Nutman - Sunnyvale CA, US
Xing Wang - Palo Alto CA, US

G06F 11/34
G06F 9/50
G06F 11/30
G06N 5/04

Various examples are disclosed for forecasting resource usage and computing capacity utilizing an exponential decay. In some examples, a computing environment can obtain usage measurements from a data stream over a time interval, where the usage measurements describe utilization of computing resource. The computing environment can generate a weight function for individual ones of the usage measurements, where the weight function exponentially decays the usage measurements based on a respective time period at which the usage measurements were obtained. The computing environment can forecast a future capacity of the computing resources based on the usage measurements and the weight function assigned to the individual ones of the usage measurements. The computing environment can further upgrade a forecast engine to use the exponential decay without resetting the forecast engine or its memory.

2020022, Jul 16, 2020

Mar 23, 2020

16/827457

- Palo Alto CA, US
Matt Roy McLaughlin - Seattle WA, US
Darren Brown - Seattle WA, US
Junyuan Lin - Seattle WA, US

VMware, Inc. - Palo Alto CA

H04L 12/24
H04L 29/08
H04L 29/06

The current document is directed to methods and systems that process, classify, efficiently store, and display large volumes of event messages generated in modern computing systems. In a disclosed implementation, received event messages are assigned to event-message clusters based on non-parameter tokens identified within the event messages. A parsing function is generated for each cluster that is used to extract data from incoming event messages and to prepare event records from event messages that more efficiently and accessible store event information. The parsing functions also provide an alternative basis for assignment of event messages to clusters. Event types associated with the clusters are used for gathering information from various information sources with which to automatically annotate event messages displayed to system administrators, maintenance personnel, and other users of event messages.

2019034, Nov 7, 2019

May 4, 2018

15/971762

- Palo Alto CA, US
Darren Brown - Seattle WA, US

VMware, Inc. - Palo Alto CA

G06F 11/07

Computational methods and systems described herein manage alerts generated by event sources that run in a distributed computing system. Methods and system provide a graphical user interface that enables a user to define a dominant alert and select subsumed alerts generated by the event sources. Methods and systems may also compute a relative fraction that represents a number of times each alert is triggered with respect to a number of times another alert is triggered for each pair of alerts. The relative fractions may be displayed in the graphical user interface to allow a user to select dominant and subsumed alerts based on the relative fractions. Methods and systems identify log messages that correspond to user-identified subsumed alerts, suppress subsumed alerts and generate the dominant alert. Methods and systems may also execute remedial action to correct the problem represented by the dominant alert.

2019016, May 30, 2019

Nov 27, 2017

15/822612

- Palo Alto CA, US
Darren Brown - Seattle WA, US
Wei Li - Palo Alto CA, US
Leah Nutman - Palo Alto CA, US
Sergio Nakai - Palo Alto CA, US

VMware, Inc. - Palo Alto CA

G06F 3/06

The current document is directed to methods and systems that collect metric data within computing facilities, including large data centers and cloud-computing facilities. In a described implementation, input metric data is compressed by replacing each metric data point with a one-bit, two-bit, four-bit, or eight-bit compressed data value. During a first time window following reception of a metric data point, the metric data point remains available in uncompressed form to facilitate data analysis and monitoring functionalities that use uncompressed metric data. During a second time window, the metric data point is compressed and stored in memory, where the compressed data point remains available for data analysis and monitoring functionalities that use compressed metric data for detection of peaks, periodic patterns, and other characteristics. Finally, the compressed data point is archived in mass storage, where it remains available to data-analysis and management functionalities for a lengthy time period.