Methods and systems for resolving performance problems with objects of a data center

1. A method, stored in one or more data-storage devices and executed using one or more processors of a computer system, for resolving probable root causes of performance problems with an object executing in a data center, the method comprising:

using machine learning to train a model that comprises rules defining relationships between probabilities of event types of log messages and values of a key performance indicator (“KPI”) of the object over a historical time period;

in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval;

using the rules to evaluate the probabilities of event types of the log messages recorded in the run-time interval for important event types;

identifying log messages with the important event types generated in the run-time interval;

displaying an alert identifying the KPI threshold violation and the log messages in a graphical user interface of an electronic display device, the log messages describing the probable root cause of the performance problem; and

executing remedial measures to correct the performance problem, the remedial measures including spinning up one or more clones of the object on one or more server computers and migrating the object to a server computer to optimize use of data center resources.

2. The method of claim 1 wherein using machine learning to train the model comprises:

for each KPI in a historical time period repeat operations comprising:

tagging KPI values that violate a KPI threshold with a first tag;

tagging KPI values that do not violate the KPI threshold with second tag;

identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;

extracting event types of the log messages with time stamps in the time interval

computing event type probabilities of the extracted event types: and

forming a probability distribution from the event type probabilities.

3. The method of claim 2 further comprising:

detecting important event types of the probability distributions using random forests based on the probability distributions and the corresponding tags of the KPI values;

reducing the probability distributions to important event type probabilities that correspond to the important event types; and

using machine learning to train a decision-tree model that comprises rules defining relationships between the important event types and the KPI values.

4. The method of claim 1 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:

identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPI threshold;

extracting event types of the log messages; and

computing run-time event type probabilities of the extracted event types in the run-time interval.

5. The method of claim 1 wherein using the rules to evaluate the event type probabilities for important event types comprises:

identifying important run-time event type probabilities in the run-time event type probabilities based on important event types; and

for each of the rules of the model repeat operations comprising:

comparing the important run-time even type distributions to the conditional statements of the rule, and

in response to the conditional statements being satisfied, identifying the important event types of the important event type probabilities that satisfy the conditional statements of the rule.

6. A computer system for resolving probable root causes of performance problems with an object executing in a data center, the computer system comprising:

one or more processors;

one or more data-storage devices; and

machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors control the system to perform operations comprising:

using machine learning to train a model that comprises rules defining relationships between probabilities of event types of log messages and values of a key performance indicator (′KPI″) of the object over a historical time period;

in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval;

using the rules to evaluate the probabilities of event types of the log messages recorded in the run-time interval for important event types;

identifying log messages with the important event types generated in the run-time interval;

displaying an alert identifying the KPI threshold violation and the log messages in a graphical user interface of an electronic display device, the log messages describing the probable root cause of the performance problem; and

executing remedial measures to correct the performance problem, the remedial measures including spinning up one or more clones of the object on one or more server computers and migrating the object to a server computer to optimize use of data center resources.

7. The system of claim 6 wherein using machine learning to train the model comprises:

for each KPI in a historical time period repeat operations comprising:

tagging KPI values that violate a KPI threshold with a first tag;

tagging KPI values that do not violate the KPI threshold with second tag;

identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;

extracting event types of the log messages with time stamps in the time interval;

computing event type probabilities of the extracted event types; and

forming a probability distribution from the event type probabilities.

8. The system of claim 7 further comprising:

detecting important event types of the probability distributions using random forests based on the probability distributions and the corresponding tags of the KPI values;

reducing the probability distributions to important event type probabilities that correspond to the important event types; and

using machine learning to train a decision-tree model that comprises rules defining relationships between the important event types and the KPI values.

9. The system of claim 6 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:

identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPI threshold;

extracting event types of the log messages; and

computing run-time event type probabilities of the extracted event types in the run-time interval.

10. The system of claim 6 wherein using the rules to evaluate the event type probabilities for important event types comprises:

identifying important run-time event type probabilities in the run-time event type probabilities based on important event types; and

for each of the rules of the model repeat operations comprising:

comparing the important run-time even type distributions to the conditional statements of the rule, and

in response to the conditional statements being satisfied, identifying the important event types of the important event type probabilities that satisfy the conditional statements of the rule.

11. A non-transitory computer-readable medium having instructions encoded thereon for enabling one or more processors of a computer system to perform operations comprising:

using machine learning to train a model that comprises rules defining relationships between probabilities of event types of log messages and values of a key performance indicator (“KPI”) of an object of a data center over a historical time period:

in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval;

using the rules to evaluate the probabilities of event types of the log messages recorded in the run-time interval for important event types;

identifying log messages with the important event types generated in the run-time interval;

displaying an alert identifying the KPI threshold violation and the log messages in a graphical user interface of an electronic display device, the log messages describing the probable root cause of the performance problem; and

executing remedial measures to correct the performance problem, the remedial measures including spinning up one or more clones of the object on one or more server computers and migrating the object to a server computer to optimize use of data center resources.

12. The medium of claim 11 wherein using machine learning to train the model comprises:

for each KPI in a historical time period repeat operations comprising:

tagging KPI values that violate a KPI threshold with a first tag;

tagging KPI values that do not violate the KPI threshold with second tag;

identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;

extracting event types of the log messages with time stamps in the time interval;

computing event type probabilities of the extracted event types; and

forming a probability distribution from the event type probabilities.

13. The medium of claim 12 further comprising

detecting important event types of the probability distributions using random forests based on the probability distributions and the corresponding tags of the KPI values;

reducing the probability distributions to important event type probabilities that correspond to the important event types; and

using machine learning to train a decision-tree model that comprises rules defining relationships between the important event types and the KPI values.

14. The medium of claim 11 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:

identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPI threshold;

extracting event types of the log messages; and

computing run-time event type probabilities of the extracted event types in the run-time interval.

15. The medium of claim 11 wherein using the rules to evaluate the event type probabilities for important event types comprises:

identifying important run-time event type probabilities in the run-time event type probabilities based on important event types; and

for each of the rules of the model repeat operations comprising:

comparing the important run-time even type distributions to the conditional statements of the rule, and

in response to the conditional statements being satisfied, identifying the important event types of the important event type probabilities that satisfy the conditional statements of the rule.