VIRTUAL MACHINE SNAPSHOTTING AND ANALYSIS

• US 20120323853A1
• Filed: 06/17/2011
• Published: 12/20/2012
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Fries, Robert, Hunt, Galen, Balakrishnan, Shobana
• Granted Patent: US 9,286,182 B2
• Time in Patent Office: Days
• US Class Current: 707/649
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 2201/815 Virtual
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

Described are techniques for capturing and analyzing snapshots of virtual machines. One or more computers may automatically obtain snapshots of virtual machines as they are executing to form a pool of virtual machine snapshots. The virtual machine snapshots are then read to obtain a set of features properties of the virtual machine snapshots, including information about a running guest operating system, software installed on the virtual machine, metadata about the virtual machine itself, and others. The features or properties are analyzed, in one embodiment using a machine learning algorithm, to automatically compute and store information about the virtual machines.

Claims

1. A method, comprising:

accessing stored virtual machine snapshots, the virtual machine snapshots having been captured from one or more executing virtual machines; and

automatically forming a pool of features comprised of features obtained from the accessed virtual machine snapshots; and

performing automated analysis on the pool of features to identify one or more traits of one or more of the virtual machine snapshots.

2. A method according to claim 1, wherein the automated analysis comprises a machine learning algorithm.

3. A method according to claim 2, wherein the automated analysis is performed using machine learning trained using a training dataset of features of training snapshots.

4. A method according to claim 1, wherein the virtual machine snapshots comprise snapshots taken at different times of a same virtual machine running at the different times.

5. A method according to claim 1, wherein the virtual machine snapshots having been captured from a hierarchy of virtual machines including parent virtual machines and child virtual machines, each child virtual machine having been produced by duplicating a corresponding parent virtual machine and then running with different state than the parent virtual machine.

6. A method according to claim 1, wherein the virtual machines run on a plurality of computer hosts, and the automated analysis either:

computes probabilities that correspond to the virtual machines, respectively;

categorizes one or more of the virtual machines into one or more pre-defined categories;

or

ranks the virtual machines relative to each other with respect to relevance to a predefined trait, wherein a rank of a virtual machine indicates its relative relevance to the predefined trait.

7. One or more computer-readable storage media storing information to cause one or more computers to perform a process, the process comprising:

performing feature extraction on a plurality of virtual machine snapshots to obtain a set of feature values of the virtual machine snapshots, the virtual machine snapshots having been captured during execution of one or more virtual machines; and

performing automated reasoning on the extracted features to rank, identify, classify, and/or compute probabilities of traits of the virtual machines that correspond to the virtual machine snapshots.

8. One or more computer-readable storage media according to claim 7, wherein, the feature extraction comprises forming feature vectors of the virtual machine snapshots, where each feature vector comprises feature values of a corresponding virtual machine snapshot, the feature values of each feature vector corresponding to a same set of feature variables that define a feature space.

9. One or more computer-readable storage media according to claim 8, the processing further comprising processing the feature vectors with a machine learning algorithm.

10. One or more computer-readable storage media according to claim 7, further comprising performing a dimension reduction algorithm that reduces a number of feature values of each feature vector passed to the machine learning algorithm.

11. One or more computer-readable storage media according to claim 7, wherein each virtual machine snapshot comprises a file system containing a guest operating system and a copy of memory as managed by a running kernel of a guest operating system.

12. One or more computer-readable storage media according to claim 11, the feature extraction comprising at least one or more of:

identifying files in the file systems, obtaining feature values by reading the copies of memory, obtaining values of hardware resources of the virtual machines, obtaining configuration settings of the guest operating systems, and obtaining information about software installed on the virtual machines.

13. One or more computer-readable storage media according to claim 7, further comprising forming a training data set by labeling one or more of the feature vectors.

14. One or more computer-readable storage media according to claim 7, further comprising using the training data set to train a model or algorithm used to perform the automated reasoning.

15. One or more computer-readable storage media according to claim 7, further comprising storing, by the one or more computers, output about the virtual machines obtained by the reasoning.

16. A method for analyzing virtual machines, the method performed by one or more computers and comprising:

automatically snapshotting the virtual machines as they are executing to form a pool of virtual machine snapshots;

reading the virtual machine snapshots to obtain a set of properties of the virtual machine snapshots; and

automatically computing and storing information about the virtual machines based on the set of properties.

17. A method according to claim 16, wherein the information about the virtual machines comprises information identifying a subset of the virtual machines.

18. A method according to claim 16, further comprising identifying one or more groups of similar or dissimilar virtual machines according to the properties, or ranking the virtual machines according to the properties.

19. A method according to claim 16, wherein the properties comprises values of property variables, the method further comprising identifying one or more property variables as predictive of a predefined condition or trait of the virtual machines.

20. A method according to claim 16, further comprising obtaining the set of properties from pieces of metadata associated with the virtual machines, respectively, the metadata comprising information about geographic locations, or hardware resources, or configurations of the virtual machines.