Early risk detection and management in a software-defined data center

1. A non-transitory machine-readable medium storing instructions executable by a processing resource to cause a computing system to perform operations comprising:

receive historical logs associated with a log source of a software-defined data center (SDDC);

parse the historical logs to determine an association rule, wherein the association rule relates a particular risk to the SDDC to a sequence of operations in the historical logs;

monitor logs associated with the log source;

determine a potential risk based on an occurrence of the sequence of operations in the logs; and

provide a notification responsive to a determination that a probability associated with the potential risk exceeds a probability threshold.

2. The medium of claim 1 , including instructions to provide the notification periodically until a countermeasure is taken.

3. The medium of claim 1 , including instructions to include a summary in the notification that includes an indication of the sequence of operations.

4. The medium of claim 1 , including instructions to perform a search for a solution associated with the potential risk.

5. The medium of claim 4 , including instructions to recommend the solution in association with the notification.

6. The medium of claim 4 , including instructions to execute a plurality of steps associated with the solution responsive to an input received via an interface.

7. The medium of claim 4 , including instructions to execute a plurality of steps associated with the solution without user input.

8. The medium of claim 1 , including instructions to request the historical logs from an archive.

9. The medium of claim 1 , wherein the association rule comprises a premise and the potential risk.

10. A system, comprising:

a plurality of log sources of a software-defined data center (SDDC); and

a log management server of the SDDC that performs operations comprising:

receive historical logs associated with each of the plurality of log sources;

determine a plurality of keywords in the historical logs, wherein each keyword precedes, and is indicative of, a risk to the SDDC;

determine a set of association rules based on the plurality of keywords, wherein each of the set of association rules relates a sequence of operations from the historical logs, including a portion of the plurality of keywords, to a particular risk to the SDDC;

monitor logs associated with the plurality of log sources;

determine a potential risk to the SDDC indicated by the logs based on the set of association rules;

determine a solution to the potential risk; and

execute a plurality of steps of the solution.

11. The system of claim 10 , wherein the log management server:

generates a task list comprising information describing a plurality of tasks of the historical logs;

stores different portions of the historical logs in a plurality of files, wherein each file corresponds to a respective task of the task list;

extracts keyword candidates from the files; and

for each keyword candidate, determines a probability that the keyword candidate is a keyword.

12. The system of claim 10 , wherein the keyword candidates include words, phrases, terms, and concepts.

13. The system of claim 10 , wherein the log management server is generates a respective term frequency-inverse document frequency (tf-idf) matrix associated with each of the plurality of keywords.

14. The system of claim 13 , wherein the log management server determines the set of association rules based on the plurality of keywords and the plurality of tf-idf matrices.

15. A method, comprising:

receiving historical logs associated with each of a plurality of log sources of a software-defined data center (SDDC);

determining a plurality of keywords in the historical logs, wherein each keyword precedes, and is indicative of, a risk to the SDDC;

determining a set of association rules based on the plurality of keywords, wherein each of the set of association rules relates a sequence of operations from the historical logs, including a portion of the plurality of keywords, to a particular risk to the SDDC;

monitoring logs associated with the plurality of log sources;

determining a set of potential risks to the SDDC indicated by the logs based on the set of association rules;

determining a subset of the set of potential risks that each exceed a probability threshold performing a search to determine a respective solution to each of the subset of potential risks; and

executing one of the solutions.

16. The method of claim 15 , wherein the method includes determining the probability threshold based on a type of customer of the SDDC.

17. The method of claim 15 , wherein the method includes displaying the subset of the set of potential risks in descending order according to a respective probability of each of the subset of the set of potential risks.

18. The method of claim 15 , wherein the method includes performing the search using a particular set of web sites.

19. The method of claim 15 , wherein the method includes executing the one of the solutions responsive to a selection of the one of the solutions via an interface.

20. The method of claim 15 , wherein executing the one of the solutions includes executing a plurality of commands made using an interface.