Dynatrace LLC

The disclosure concerns the time-based correlation of time series for the root cause analysis of application monitoring data, observability data, and data observability data in the field of application monitoring and observability. The object of the disclosure is to find at least one candidate time series that has a high chance/probability for causing an event in a reference time series. The method shall be time-based and not frequency based. The method includes: constructing a simplified reference time series retaining changes in the reference time series and setting other points to zero; constructing a simplified candidate time series retaining changes in the candidate time series and setting other points to zero; calculating a similarity metric between the simplified candidate time series and the simplified reference time series; and reporting an occurrence of a computing event in response to the similarity metric exceeding a threshold value.

A computer-implemented method is presented for determining primary keys in a table of a database system. The method includes: determining a number of rows in the table; for a given column of the table, generating a probabilistic data structure for the given column, where the probabilistic data structure is partitioned into a plurality of registers and configuration parameters for the probabilistic data structure includes a first recording parameter, base, that controls recording of data into the probabilistic data structure; computing a cardinality estimate for the given column using the probabilistic data structure; computing a ratio between the cardinality estimate for the given column and the number of rows in the table; comparing the ratio to a threshold; and designating the given column as a primary key for the table in response to the ratio being greater than the threshold.

The disclosure concerns the time-based correlation of time series for the root cause analysis of application monitoring data, observability data, and data observability data in the field of application monitoring and observability. The object of the disclosure is to find at least one candidate time series that has a high chance/probability for causing an event in a reference time series. The method shall be time-based and not frequency based. The method includes: constructing a simplified reference time series retaining changes in the reference time series and setting other points to zero; constructing a simplified candidate time series retaining changes in the candidate time series and setting other points to zero; calculating a similarity metric between the simplified candidate time series and the simplified reference time series; and reporting an occurrence of a computing event in response to the similarity metric exceeding a threshold value.

A serialization data format for the transfer, analysis, and modification of schemaless mass data is proposed. The data format supports stream oriented, pipeline-based processing, and it enables read access of contained data without deserialization, and modification access that only requires the deserialization of portions of structure and meta data. Incoming, semi-structured data records may be transformed into records of the proposed serialization data format, compressed and stored in processing buffers containing multiple of those records. During processing, only individual records are decompressed, and processed records are then compressed and stored in output processing buffers for efficient memory usage. Manipulations of data records are performed by appending new values to data records, invalidating old ones and updating access data structures to refer to new values instead of old ones, to enable various modification activities by only requiring append or not-size-changing operations of serialized data records.

A computer-implemented method is presented for storing and querying records from a data segment. The objective of the disclosure is to find computer-implemented methods for storing and querying records from a data segment that are fast and space efficient storing and querying of APM data stored in a segmented database.

A computer-implemented method is presented for storing log data generated in a distributed computing environment. The method includes: receiving a data element from a log line, where the data element is associated with a given storage entity containing the log line; applying a hash function to the data element to generate a hash value; updating a listing of storage entities with the given entity, where entries in the listing of entities are configured to identify more than one entity and each entry in the listing of entities specifies a unique set of entities; and storing the hash value, along with an address, in a probabilistic data structure, where the address maps the hash value to an entry in the listing of entities.

A computer-implemented method is presented for storing log data generated in a distributed computing environment. The method includes: receiving a log line, where the log line is associated with a given computing source producing the log line; applying a first tokenization rule to create a plurality of base tokens; applying a second tokenization rule to create a plurality of combination tokens; applying a third tokenization rule to create a plurality of n-gram tokens; combining the plurality of tokens into a set of tokens; for each token in the set of tokens, storing a given token by applying a hash function to the given token to generate a hash value, where the given token is associated with a given computing source at which the log line was produced; updating a listing of computing entities with the given computing source, where entries in the listing of computing entities can identify more than one computing sources and each entry in the listing of computing entities specifies a unique set of computing sources; and storing the hash value, along with an address, in a token map table of a probabilistic data structure, where the address maps the hash value to an entry in the listing of computing entities.

The disclosure relates to a computer-implemented method for simulating performance of a web application. The technical problem solved by the disclosure is to identify aspects of a web application that greatly affect user retention and to quantify user retention by modifying the identified aspects of the web application. This is solved by a collecting monitoring data associated with interactions between users and the web application; training a machine learning model with training data; generating virtual performance metrics for the web application; simulating a rate of users leaving the web application based on the virtual performance metrics; identifying at least one modified performance metric causing a change in user retention; and outputting a recommendation specific to the web application.

A technology is disclosed for estimating the impact that heap memory allocations have on the behavior of garbage collection activities. A sampling mechanism randomly and unbiased selects a subset of allocations for detailed analysis. A detailed analysis is performed for the selected allocation activities. Allocation monitoring data, including type and size of the allocated object and data describing the code location on which the allocation was performed are gathered. Further, the point in time, when the allocated object is later reclaimed by garbage collection is recorded. Gathered object allocation and reclaim data are used to estimate for individual allocation sites or types of allocated objects, the number of bytes that are allocated, and the number of bytes that survived a garbage collection run. Allocation activity causing frequently garbage collection runs is identified using allocation size data and the survived byte counts are used to identify allocation activity causing long garbage collection runs. Further allocation monitoring data is correlated with transaction trace data to identify the impact of transactions or transaction classes on garbage collection behavior.

A computer-implemented technique is presented for analyzing log messages. The method includes: receiving a plurality of log message from a list of log messages; for each log message in the log messages, generating a fingerprint for the log message and appending the fingerprint to the log message, where the fingerprint is comprised of punctuation characters in the log message; sorting the log messages in the list of log messages according to the punctuation characters comprising a fingerprint for a given log message; and clustering log messages in the sorted list of log messages into a final set of clusters, where each cluster in the final set of clusters includes one or more log messages and the log messages in each cluster have fingerprints similar to other log messages in the cluster.