Methods and systems for using machine learning to resolve performance problems with objects of a data center

1. A method, stored in one or more data-storage devices and executed using one or more processors of a computer system, for resolving probable root causes of performance problems with an object executing in a data center, the method comprising:

using machine learning to obtain rules that define relationships between probabilities of event types of log messages and values of a key performance indictor (“KPI”);

in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval that ends with the time of the run-time KPI violation;

using the rules to determine important event types of the event-type probabilities in the run-time interval:

retrieving log messages from a log database, the retrieved log messages corresponding to the important event types and describe probable root causes of the performance problems; and

executing remedial measures that resolve the performance problems with the object based on the retrieved log messages, the remedial measures including restarting a host, restarting the object, adjusting memory or CPU allocation to the object, and migrating virtual objects to different hosts.

2. The method of claim 1 wherein using machine learning to obtain rules comprises:

for each KPI in a historical time period repeat operations comprising:

tagging KPI values that violate a KPI threshold with a first class label;

tagging KPI values that do not violate the KPI threshold with second class label;

identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;

extracting event types of the log messages with time stamps in the time interval;

computing event-type probabilities of the extracted event types; and

forming a probability distribution from the event-type probabilities.

3. The method of claim 2 further comprising:

using hyperparameter tuning with machine learning to train a random forest model that defines relationships between the event types and the class labels;

using performance feature importance to identify important event types of the random forest models;

displaying a graphical user interface that enables a user to select important event types based on corresponding log messages that are associated with performance problems; and

using rule learning to form the rules.

4. The method of claim 1 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:

identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPK threshold;

extracting event types of the log messages; and

computing run-time event-type probabilities of the extracted event types in the run-time interval.

5. The method of claim 1 wherein using the rules to evaluate the event-type probabilities for important event types comprises:

identifying important run-time event-type probabilities in the run-time event-type probabilities based on important event types; and

for each of the rules of the model repeat operations comprising:

comparing the important run-time even type distributions to the conditional statements of the rule, and

in response to the conditional statements being satisfied, identifying the important event types of the important event-type probabilities that satisfy the conditional statements of the rule.

6. A computer system for resolving probable root causes of performance problems with an object executing in a data center, the computer system comprising:

one or more processors;

one or more data-storage devices; and

machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors control the system to performance operations comprising:

using machine learning to obtain rules that define relationships between probabilities of event types of log messages and values of a key performance indictor (“KPI”);

in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval that ends with the time of the run-time KPI violation;

using the rules to determine important event types of the event-type probabilities in the run-time interval:

retrieving log messages from a log database, the retrieved log messages corresponding to the important event types and describe probable root causes of the performance problems; and

executing remedial measures that resolve the performance problems with the object based on the retrieved log messages, the remedial measures including restarting a host, restarting the object, adjusting memory or CPU allocation to the object, and migrating virtual objects to different hosts.

7. The system of claim 6 wherein using machine learning to obtain rules comprises:

for each KPI in a historical time period repeat operations comprising:

tagging KPI values that violate a KPI threshold with a first class label;

tagging KPI values that do not violate the KPI threshold with second class label;

identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;

extracting event types of the log messages with time stamps in the time interval;

computing event-type probabilities of the extracted event types; and

forming a probability distribution from the event-type probabilities.

8. The system of claim 7 further comprising:

using hyperparameter tuning with machine learning to train a random forest model that defines relationships between the event types and the class labels;

using performance feature importance to identify important event types of the random forest models;

displaying a graphical user interface that enables a user to select important event types based on corresponding log messages that are associated with performance problems; and

using rule learning to form the rules.

9. The system of claim 6 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:

identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPK threshold;

extracting event types of the log messages; and

computing run-time event-type probabilities of the extracted event types in the run-time interval.

10. The system of claim 6 wherein using the rules to evaluate the event-type probabilities for important event types comprises:

identifying important run-time event-type probabilities in the run-time event-type probabilities based on important event types; and

for each of the rules of the model repeat operations comprising:

comparing the important run-time even type distributions to the conditional statements of the rule, and

in response to the conditional statements being satisfied, identifying the important event types of the important event-type probabilities that satisfy the conditional statements of the rule.

11. A non-transitory computer-readable medium having instructions encoded thereon for enabling one or more processors of a computer system to perform operations comprising:

using machine learning to obtain rules that define relationships between probabilities of event types of log messages and values of a key performance indictor (“KPI”);

in response to detecting a run-time KPI violation of a KPI threshold, determining probabilities of event types of log messages recorded in a run-time interval that ends with the time of the run-time KPI violation;

using the rules to determine important event types of the event-type probabilities in the run-time interval;

retrieving log messages from a log database, the retrieved log messages corresponding to the important event types and describe probable root causes of the performance problems; and

executing remedial measures that resolve the performance problems with the object based on the retrieved log messages, the remedial measures including restarting a host, restarting the object, adjusting memory or CPU allocation to the object, and migrating virtual objects to different hosts.

12. The medium of claim 11 wherein using machine learning to obtain rules comprises:

for each KPI in a historical time period repeat operations comprising:

tagging KPI values that violate a KPI threshold with a first class label;

tagging KPI values that do not violate the KPI threshold with second class label;

identifying log messages of a log file with time stamps in a time interval that ends with a time stamp of the KPI value;

extracting event types of the log messages with time stamps in the time interval;

computing event-type probabilities of the extracted event types; and

forming a probability distribution from the event-type probabilities.

13. The medium of claim 12 further comprising:

using hyperparameter tuning with machine learning to train a random forest model that defines relationships between the event types and the class labels;

using performance feature importance to identify important event types of the random forest models;

displaying a graphical user interface that enables a user to select important event types based on corresponding log messages that are associated with performance problems; and

using rule learning to form the rules.

14. The medium of claim 11 wherein determining probabilities of event types of the log messages recorded in the run-time interval comprises:

identifying log messages of a log file with time stamps in the run-time interval that ends at a time stamp of the KPI value that violates the KPK threshold;

extracting event types of the log messages; and

computing run-time event-type probabilities of the extracted event types in the run-time interval.

15. The medium of claim 11 wherein using the rules to evaluate the event-type probabilities for important event types comprises:

identifying important run-time event-type probabilities in the run-time event-type probabilities based on important event types; and

for each of the rules of the model repeat operations comprising:

comparing the important run-time even type distributions to the conditional statements of the rule, and

in response to the conditional statements being satisfied, identifying the important event types of the important event-type probabilities that satisfy the conditional statements of the rule.