Application discovery based on application logs

Patent metadata

Field	Value
Publication number	US-10666743-B2
Application number	US-201815959321-A
Country	US
Kind code	B2
Filing date	Apr 23, 2018
Priority date	Apr 23, 2018
Publication date	May 26, 2020
Grant date	May 26, 2020

Abstract

Techniques for discovery of applications based on application logs are disclosed. In one embodiment, a system may include a log analyzer to receive application logs generated by a plurality of applications running in a computing environment and analyze the received application logs using a trained initialization model to parse information about the plurality of applications. Further, the system may include an application discovery unit to determine a presence of an application running on a compute node in the computing environment using the parsed information about the plurality of applications.

First claim

What is claimed is:

1. A system comprising:
a processor; and
memory coupled to the processor, wherein the memory comprises:
a log analyzer to:
receive application logs generated by a plurality of applications running in a computing environment; and
parse the received application logs using a trained initialization model and a garbage collection model to detect information about the plurality of applications, wherein the initialization model and the garbage collection model are trained using machine learning and natural language processing methods to scan the application logs for an initialization event and/or a disconnection event of the plurality of applications, respectively; and an application discovery unit to;
determine a presence of an application running on a compute node in the computing environment using the detected information about the plurality of applications, wherein the trained initialization model is to determine a state indicative of the presence of the application as active by parsing the application logs associated with the determined application, and wherein the trained garbage collection model is to determine the state indicative of the presence of the application as inactive by parsing the application logs associated with the determined application.

2. The system of claim 1 , further comprising:
a triggering unit to activate an application specific agent associated with the application, wherein the application specific agent is to deploy, advance monitor, and/or manage the application in the computing environment.

3. The system of claim 1 , wherein the application discovery unit is to:
determine individual components of the application using the detected information upon determining the presence of the application.

4. The system of claim 1 , wherein the application discovery unit is to:
store the state indicative of the presence of the application.

5. The system of claim 1 , wherein the compute node comprises one of a virtual machine, a container, or a physical machine, and wherein the plurality of applications run in a single cloud or distributed across multiple clouds.

6. The system of claim 1 , wherein the initialization model and the garbage collection model are trained on input words and/or strings of words using the machine learning and natural language processing methods, and wherein the input words and/or strings of words are selected from historical application logs.

7. The system of claim 1 , further comprising:
a log inventory service to index the application logs generated by the plurality of applications, wherein the log analyzer is to receive the indexed application logs from the log inventory service.

8. The system of claim 1 , wherein the trained garbage collection model is to determine the state indicative of the presence of the application as inactive when the garbage collection model encounters stop or deleted events for the determined application in the application logs.

9. The system of claim 1 , wherein the trained garbage collection model is to determine the state indicative of the presence of the application as inactive when the garbage collection model does not get the application logs for the determined application for a predefined interval of time.

10. The system of claim 1 , wherein the trained initialization model is to determine a state indicative of the presence of the application as active when the trained initialization model detects the initialization event for the determined application.

11. A method comprising:
receiving, by a log analyzer, application logs generated by a plurality of applications running in a computing environment;
parsing, by the log analyzer, the received application logs using a trained initialization model and a garbage collection model to detect information about the plurality of applications, wherein the initialization model and the garbage collection model are trained using machine learning and natural language processing methods to scan the application logs for an initialization event and/or a disconnection event of the plurality of applications, respectively;
determining, an application discovery unit, a presence of an application running on a compute node in the computing environment using the detected information;
determining a state indicative of the presence of the application as active by parsing the application logs associated with the determined application using the trained initialization model; and
determining the state indicative of the presence ofthe application as inactive by parsing the application logs associated with the determined application using the trained garbage collection model.

12. The method of claim 11 , further comprising:
generating a trigger to deploy, advance monitor, and/or manage the application in the computing environment.

13. The method of claim 12 , wherein the application is monitored for health, connections, and/or resource usage, and wherein managing the application comprises performing a management function on the application based on the advance monitoring.

14. The method of claim 11 , wherein the initialization model and the garbage collection model are trained on input words and/or strings of words using the machine learning and natural language processing methods, and wherein the input words and/or strings of words are selected from historical application logs.

15. The method of claim 11 , comprising:
indexing the application logs generated by the plurality of applications in a log inventory service, wherein the application logs are received by the log analyzer from the log inventory service.

16. The method of claim 11 , wherein the plurality of applications run in a single cloud or distributed across multiple clouds.

17. A non-transitory machine-readable storage medium encoded with instructions that, when executed by a processor, cause the processor to:
retrieve application logs generated by a plurality of applications running in a computing environment;
parse the retrieved application logs using a trained initialization model and a garbage collection model to detect information about the plurality of applications, wherein the initialization model and the garbage collection model are trained using machine learning and natural language processing methods to scan the application logs for an initialization event and/or a disconnection event of the plurality of applications, respectively;
determine a presence of an application running on a compute node in the computing environment using the detected information;
determine a state indicative of the presence of the application as active by parsing the application logs associated with the determined application using the trained garbage collection model; and
determine the state indicative of the presence of the application as inactive by parsing the application logs associated with the determined application using the trained garbage collection model.

18. The non-transitory machine-readable storage medium of claim 17 , further comprising instructions to:
trigger an application specific agent to deploy, monitor, and/or manage the application in the computing environment.

19. The non-transitory machine-readable storage medium of claim 17 , comprising instructions to:
determine individual components of the application using the detected information upon determining the presence of the application.

20. The non-transitory machine-readable storage medium of claim 17 wherein the initialization model and the garbage colle

Assignees

• Vmware Inc

Inventors

• Sahoo Sidhartha
• Chaudhary Vipul
• Hegde Sandeep L
• Sridharan Arunvijai

Classifications

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title

• H04L41/5041

  characterised by the time relationship between creation and deployment of a service · CPC title

• G06F11/0787

  Storage of error reports, e.g. persistent data storage, storage using memory protection · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title