TECHNICAL FIELD
This disclosure is directed to automated methods and systems to manage computational resource of a distributed computing system, and, in particular, to forecasting resource usage and proactively adjust resource usage based on the forecast.
BACKGROUND
Electronic computing has evolved from primitive, vacuumtubebased computer systems, initially developed during the 1940s, to modern electronic computing systems in which large numbers of multiprocessor computer systems, such as server computers, work stations, and other individual computing systems are networked together with largecapacity datastorage devices and other electronic devices to produce geographically distributed computing systems with hundreds of thousands, millions, or more components that provide enormous computational bandwidths and datastorage capacities. These large, distributed computing systems are made possible by advances in computer networking, distributed operating systems and applications, datastorage appliances, computer hardware, and software technologies.
Because distributed computing systems have an enormous number of computational resources, various management systems have been developed to collect performance information about these resources, and based on the information, detect performance problems and generate alerts when a performance problem occurs. For example, a typical management system may collect hundreds of thousands of streams of metric data to monitor various computational resources of a data center infrastructure. Each data point of a stream of metric data may represent an amount of the resource in use at a point in time. However, the enormous number of metric data streams received by a management system makes it impossible for information technology (“IT”) administrators to manually monitor the metrics, detect performance issues, and respond in real time. Failure to respond in real time to performance problems can interrupt computer services and have enormous cost implications for data center tenants, such as when a tenant'"'"'s server applications stop running or fail to timely respond to client requests.
Typical management systems use reactive monitoring to generate an alert when metric data of a corresponding resource violates a usage limit. Although reactive monitoring techniques are useful for identifying current performance problems, reactive monitoring techniques have scalability limitations and force IT administrators to react immediately to performance problems that have already started to impact the performance of computational resources or are imminent. For example, by the time an IT administrator has been alerted by a management system that metric data for memory usage of a server computer has violated a usage limit, applications, VMs and containers running on the server computer may have already stopped running or slowed significantly. As a result, the IT administrator has to immediately execute remedial measures, which is error prone and may only temporarily address the performance problem. IT administrators seek management systems that identify performance problems in advance so that IT administrators have sufficient time to assess the problems and implement appropriate remedial measures that avoid future interruptions in computational services.
SUMMARY
Computational methods and systems to proactively manage usage of computational resources of a distributed computing system are described. Streams of metric data representing usage of various resources of the distributed computing system are sent to a management system of the distributed computing system. For each userselected resource of the distributed computed system, the management system computes an estimated trend in most recently sequence of metric data that represents latest usage of a resource of the distributed computing system. If the sequence of metric data has an increasing or decreasing trend, the sequence of metric data may be detrended to obtain a sequence of nontrendy metric data. Otherwise, the sequence of metric data is nontrendy metric data. Two or more stochastic process models of the sequence of nontrendy metric data are computed and corresponding accumulated residual errors are computed as new metric day representing latest usage of the resource are received by the management system. Pulse wave and seasonal models of the sequence of nontrendy metric data are also computed. When a forecast request for resource usage over a forecast interval is received, a sequence of forecasted metric data over the forecast interval is computed. The forecasted metric data is computed based on the estimated trend and one of the pulse wave or seasonal model that matches the periodicity of the sequence of nontrendy metric data. Alternatively, when neither pulse wave model nor the seasonal model matches the periodicity of the sequence of nontrendy metric data, the sequence of forecasted metric data is computed over the forecast interval based on the estimated trend and the stochastic process model with a smallest corresponding accumulated residual error. Usage of the resource by virtual objects of the distributed computing system may be adjusted based on the sequence of forecasted metric data.
DESCRIPTION OF THE DRAWINGS
FIG. 1 shows an architectural diagram for various types of computers.
FIG. 2 shows an Internetconnected distributed computer system.
FIG. 3 shows cloud computing.
FIG. 4 shows generalized hardware and software components of a generalpurpose computer system.
FIGS. 5A5B show two types of virtual machine (“VM”) and VM execution environments.
FIG. 6 shows an example of an open virtualization format package.
FIG. 7 shows virtual data centers provided as an abstraction of underlying physicaldatacenter hardware components.
FIG. 8 shows virtualmachine components of a virtualdatacenter management server and physical servers of a physical data center.
FIG. 9 shows a clouddirector level of abstraction.
FIG. 10 shows virtualcloudconnector nodes.
FIG. 11 shows an example server computer used to host three containers.
FIG. 12 shows an approach to implementing the containers on a VM.
FIG. 13A shows an example of a virtualization layer located above a physical data center.
FIG. 13B shows a management system receiving streams of metric data.
FIG. 14A14D show plots of four different example streams of metric data.
FIG. 15 shows an architecture of an example metric data analytics system that may be implemented as part of a management system.
FIG. 16 shows an example implementation of the analytics services manager.
FIG. 17 shows an example of a history of metric data maintained by a metric processor of the forecast engine.
FIG. 18 shows an overview of example processing operations carried out by a metric processor.
FIGS. 19A19C show an example of computing a trend estimate and detrending metric data within a historical window.
FIG. 20 shows example weight parameters for three autoregressive movingaverage models.
FIG. 21 shows an example of a latest nontrendy metric data value and three forecasted nontrendy metric data values with the same time stamp.
FIG. 22 shows an example sequence of forecasted nontrendy metric data.
FIG. 23 shows a plot of an example stream of metric data that exhibits a pulse wave pattern.
FIG. 24 shows a plot of an example stream of metric data that exhibits a seasonal wave pattern.
FIGS. 25A25D shows edge detection applied to a sequence of metric data.
FIG. 26A shows a plot of gradients that correspond to edges of pulses in a pulsewave stream of metric data.
FIG. 26B shows pulse widths and periods of the pulses in the pulsewave stream of metric data of FIG. 26A.
FIG. 27 shows a bar graph of three different examples of coarse sampling rates and associated streams of metric data.
FIG. 28 shows an example of periodograms for a series of shorttime windows of nontrendy metric data.
FIG. 29A show a plot of a periodogram.
FIG. 29B shows a plot of an autocorrelation function that corresponds to the periodogram shown in FIG. 29A.
FIG. 29C shows examples of a local maximum and a local minimum in neighborhoods of the autocorrelation function shown in FIG. 29B.
FIGS. 30A30B show plots of example periodic parameters for a pulse wave model and a seasonal model, respectively.
FIG. 31A shows a plot of example trendy, nonperiodic metric data and forecasted metric data over a forecast interval.
FIG. 31B shows a plot of example trendy, pulsewave metric data and forecasted metric data over a forecast interval.
FIG. 31C shows a plot of example trendy, periodic metric data and forecasted metric data over a forecast interval
FIGS. 32A32C show an example of planning optimal resource usage for a cluster of server computers.
FIG. 33 shows a controlflow diagram of a method to manage a resource of a distributed computing system.
FIG. 34 shows a controlflow diagram of a routine “remove trend from the stream” called in FIG. 33.
FIG. 35 shows a controlflow diagram of a routine “compute stochastic process models” called in FIG. 33.
FIG. 36 shows a controlflow diagram of a routine “compute periodic models” called in FIG. 33.
FIG. 37 shows a controlflow diagram of a routine “apply edge detection” called in FIG. 36.
FIG. 38 shows a controlflow diagram of a routine “compute seasonal period parameters” called in FIG. 36.
FIG. 39 shows controlflow diagram of a routine “compute period of stream” called in FIG. 38.
FIG. 40 shows a controlflow diagram a routine “compute forecast” called in FIG. 33.
DETAILED DESCRIPTION
This disclosure presents computational methods and systems to proactively manage resources in a distributed computing system. In a first subsection, computer hardware, complex computational systems, and virtualization are described. Containers and containers supported by virtualization layers are described in a second subsection. Methods to proactively manage resources in a distributed computing system are described below in a fourth subsection.
Computer Hardware, Complex Computational Systems, and Virtualization
The term “abstraction” is not, in any way, intended to mean or suggest an abstract idea or concept. Computational abstractions are tangible, physical interfaces that are implemented, ultimately, using physical computer hardware, datastorage devices, and communications systems. Instead, the term “abstraction” refers, in the current discussion, to a logical level of functionality encapsulated within one or more concrete, tangible, physicallyimplemented computer systems with defined interfaces through which electronicallyencoded data is exchanged, process execution launched, and electronic services are provided. Interfaces may include graphical and textual data displayed on physical display devices as well as computer programs and routines that control physical computer processors to carry out various tasks and operations and that are invoked through electronically implemented application programming interfaces (“APIs”) and other electronically implemented interfaces. There is a tendency among those unfamiliar with modern technology and science to misinterpret the terms “abstract” and “abstraction,” when used to describe certain aspects of modern computing. For example, one frequently encounters assertions that, because a computational system is described in terms of abstractions, functional layers, and interfaces, the computational system is somehow different from a physical machine or device. Such allegations are unfounded. One only needs to disconnect a computer system or group of computer systems from their respective power supplies to appreciate the physical, machine nature of complex computer technologies. One also frequently encounters statements that characterize a computational technology as being “only software,” and thus not a machine or device. Software is essentially a sequence of encoded symbols, such as a printout of a computer program or digitally encoded computer instructions sequentially stored in a file on an optical disk or within an electromechanical massstorage device. Software alone can do nothing. It is only when encoded computer instructions are loaded into an electronic memory within a computer system and executed on a physical processor that socalled “software implemented” functionality is provided. The digitally encoded computer instructions are an essential and physical control component of processorcontrolled machines and devices, no less essential and physical than a camshaft control system in an internalcombustion engine. Multicloud aggregations, cloudcomputing services, virtualmachine containers and virtual machines, containers, communications interfaces, and many of the other topics discussed below are tangible, physical components of physical, electroopticalmechanical computer systems.
FIG. 1 shows a general architectural diagram for various types of computers. Computers that receive, process, and store event messages may be described by the general architectural diagram shown in FIG. 1, for example. The computer system contains one or multiple central processing units (“CPUs”) 102105, one or more electronic memories 108 interconnected with the CPUs by a CPU/memorysubsystem bus 110 or multiple busses, a first bridge 112 that interconnects the CPU/memorysubsystem bus 110 with additional busses 114 and 116, or other types of highspeed interconnection media, including multiple, highspeed serial interconnects. These busses or serial interconnections, in turn, connect the CPUs and memory with specialized processors, such as a graphics processor 118, and with one or more additional bridges 120, which are interconnected with highspeed serial links or with multiple controllers 122127, such as controller 127, that provide access to various different types of massstorage devices 128, electronic displays, input devices, and other such components, subcomponents, and computational devices. It should be noted that computerreadable datastorage devices include optical and electromagnetic disks, electronic memories, and other physical datastorage devices. Those familiar with modem science and technology appreciate that electromagnetic radiation and propagating signals do not store data for subsequent retrieval, and can transiently “store” only a byte or less of information per mile, far less information than needed to encode even the simplest of routines.
Of course, there are many different types of computersystem architectures that differ from one another in the number of different memories, including different types of hierarchical cache memories, the number of processors and the connectivity of the processors with other system components, the number of internal communications busses and serial links, and in many other ways. However, computer systems generally execute stored programs by fetching instructions from memory and executing the instructions in one or more processors. Computer systems include generalpurpose computer systems, such as personal computers (“PCs”), various types of server computers and workstations, and higherend mainframe computers, but may also include a plethora of various types of specialpurpose computing devices, including datastorage systems, communications routers, network nodes, tablet computers, and mobile telephones.
FIG. 2 shows an Internetconnected distributed computer system. As communications and networking technologies have evolved in capability and accessibility, and as the computational bandwidths, datastorage capacities, and other capabilities and capacities of various types of computer systems have steadily and rapidly increased, much of modern computing now generally involves large distributed systems and computers interconnected by local networks, widearea networks, wireless communications, and the Internet. FIG. 2 shows a typical distributed system in which a large number of PCs 202205, a highend distributed mainframe system 210 with a large datastorage system 212, and a large computer center 214 with large numbers of rackmounted server computers or blade servers all interconnected through various communications and networking systems that together comprise the Internet 216. Such distributed computing systems provide diverse arrays of functionalities. For example, a PC user may access hundreds of millions of different web sites provided by hundreds of thousands of different web servers throughout the world and may access highcomputationalbandwidth computing services from remote computer facilities for running complex computational tasks.
Until recently, computational services were generally provided by computer systems and data centers purchased, configured, managed, and maintained by serviceprovider organizations. For example, an ecommerce retailer generally purchased, configured, managed, and maintained a data center including numerous web server computers, backend computer systems, and datastorage systems for serving web pages to remote customers, receiving orders through the webpage interface, processing the orders, tracking completed orders, and other myriad different tasks associated with an ecommerce enterprise.
FIG. 3 shows cloud computing. In the recently developed cloudcomputing paradigm, computing cycles and datastorage facilities are provided to organizations and individuals by cloudcomputing providers. In addition, larger organizations may elect to establish private cloudcomputing facilities in addition to, or instead of, subscribing to computing services provided by public cloudcomputing service providers. In FIG. 3, a system administrator for an organization, using a PC 302, accesses the organization'"'"'s private cloud 304 through a local network 306 and privatecloud interface 308 and also accesses, through the Internet 310, a public cloud 312 through a publiccloud services interface 314. The administrator can, in either the case of the private cloud 304 or public cloud 312, configure virtual computer systems and even entire virtual data centers and launch execution of application programs on the virtual computer systems and virtual data centers in order to carry out any of many different types of computational tasks. As one example, a small organization may configure and run a virtual data center within a public cloud that executes web servers to provide an ecommerce interface through the public cloud to remote customers of the organization, such as a user viewing the organization'"'"'s ecommerce web pages on a remote user system 316.
Cloudcomputing facilities are intended to provide computational bandwidth and datastorage services much as utility companies provide electrical power and water to consumers. Cloud computing provides enormous advantages to small organizations without the devices to purchase, manage, and maintain inhouse data centers. Such organizations can dynamically add and delete virtual computer systems from their virtual data centers within public clouds in order to track computationalbandwidth and datastorage needs, rather than purchasing sufficient computer systems within a physical data center to handle peak computationalbandwidth and datastorage demands. Moreover, small organizations can completely avoid the overhead of maintaining and managing physical computer systems, including hiring and periodically retraining informationtechnology specialists and continuously paying for operatingsystem and databasemanagementsystem upgrades. Furthermore, cloudcomputing interfaces allow for easy and straightforward configuration of virtual computing facilities, flexibility in the types of applications and operating systems that can be configured, and other functionalities that are useful even for owners and administrators of private cloudcomputing facilities used by a single organization.
FIG. 4 shows generalized hardware and software components of a generalpurpose computer system, such as a generalpurpose computer system having an architecture similar to that shown in FIG. 1. The computer system 400 is often considered to include three fundamental layers: (1) a hardware layer or level 402; (2) an operatingsystem layer or level 404; and (3) an applicationprogram layer or level 406. The hardware layer 402 includes one or more processors 408, system memory 410, various different types of inputoutput (“I/O”) devices 410 and 412, and massstorage devices 414. Of course, the hardware level also includes many other components, including power supplies, internal communications links and busses, specialized integrated circuits, many different types of processorcontrolled or microprocessorcontrolled peripheral devices and controllers, and many other components. The operating system 404 interfaces to the hardware level 402 through a lowlevel operating system and hardware interface 416 generally comprising a set of nonprivileged computer instructions 418, a set of privileged computer instructions 420, a set of nonprivileged registers and memory addresses 422, and a set of privileged registers and memory addresses 424. In general, the operating system exposes nonprivileged instructions, nonprivileged registers, and nonprivileged memory addresses 426 and a systemcall interface 428 as an operatingsystem interface 430 to application programs 432436 that execute within an execution environment provided to the application programs by the operating system. The operating system, alone, accesses the privileged instructions, privileged registers, and privileged memory addresses. By reserving access to privileged instructions, privileged registers, and privileged memory addresses, the operating system can ensure that application programs and other higherlevel computational entities cannot interfere with one another'"'"'s execution and cannot change the overall state of the computer system in ways that could deleteriously impact system operation. The operating system includes many internal components and modules, including a scheduler 442, memory management 444, a file system 446, device drivers 448, and many other components and modules. To a certain degree, modern operating systems provide numerous levels of abstraction above the hardware level, including virtual memory, which provides to each application program and other computational entities a separate, large, linear memoryaddress space that is mapped by the operating system to various electronic memories and massstorage devices. The scheduler orchestrates interleaved execution of various different application programs and higherlevel computational entities, providing to each application program a virtual, standalone system devoted entirely to the application program. From the application program'"'"'s standpoint, the application program executes continuously without concern for the need to share processor devices and other system devices with other application programs and higherlevel computational entities. The device drivers abstract details of hardwarecomponent operation, allowing application programs to employ the systemcall interface for transmitting and receiving data to and from communications networks, massstorage devices, and other I/O devices and subsystems. The file system 446 facilitates abstraction of massstoragedevice and memory devices as a highlevel, easytoaccess, filesystem interface. Thus, the development and evolution of the operating system has resulted in the generation of a type of multifaceted virtual execution environment for application programs and other higherlevel computational entities.
While the execution environments provided by operating systems have proved to be an enormously successful level of abstraction within computer systems, the operatingsystemprovided level of abstraction is nonetheless associated with difficulties and challenges for developers and users of application programs and other higherlevel computational entities. One difficulty arises from the fact that there are many different operating systems that run within various different types of computer hardware. In many cases, popular application programs and computational systems are developed to run on only a subset of the available operating systems and can therefore be executed within only a subset of the different types of computer systems on which the operating systems are designed to run. Often, even when an application program or other computational system is ported to additional operating systems, the application program or other computational system can nonetheless run more efficiently on the operating systems for which the application program or other computational system was originally targeted. Another difficulty arises from the increasingly distributed nature of computer systems. Although distributed operating systems are the subject of considerable research and development efforts, many of the popular operating systems are designed primarily for execution on a single computer system. In many cases, it is difficult to move application programs, in real time, between the different computer systems of a distributed computer system for highavailability, faulttolerance, and loadbalancing purposes. The problems are even greater in heterogeneous distributed computer systems which include different types of hardware and devices running different types of operating systems. Operating systems continue to evolve, as a result of which certain older application programs and other computational entities may be incompatible with more recent versions of operating systems for which they are targeted, creating compatibility issues that are particularly difficult to manage in large distributed systems.
For all of these reasons, a higher level of abstraction, referred to as the “virtual machine,” (“VM”) has been developed and evolved to further abstract computer hardware in order to address many difficulties and challenges associated with traditional computing systems, including the compatibility issues discussed above. FIGS. 5AB show two types of VM and virtualmachine execution environments. FIGS. 5AB use the same illustration conventions as used in FIG. 4. Figure SA shows a first type of virtualization. The computer system 500 in FIG. 5A includes the same hardware layer 502 as the hardware layer 402 shown in FIG. 4. However, rather than providing an operating system layer directly above the hardware layer, as in FIG. 4, the virtualized computing environment shown in FIG. 5A features a virtualization layer 504 that interfaces through a virtualizationlayer/hardwarelayer interface 506, equivalent to interface 416 in FIG. 4, to the hardware.
The virtualization layer 504 provides a hardwarelike interface to a number of VMs, such as VM 510, in a virtualmachine layer 511 executing above the virtualization layer 504. Each VM includes one or more application programs or other higherlevel computational entities packaged together with an operating system, referred to as a “guest operating system,” such as application 514 and guest operating system 516 packaged together within VM 510. Each VM is thus equivalent to the operatingsystem layer 404 and applicationprogram layer 406 in the generalpurpose computer system shown in FIG. 4. Each guest operating system within a VM interfaces to the virtualization layer interface 504 rather than to the actual hardware interface 506. The virtualization layer 504 partitions hardware devices into abstract virtualhardware layers to which each guest operating system within a VM interfaces. The guest operating systems within the VMs, in general, are unaware of the virtualization layer and operate as if they were directly accessing a true hardware interface. The virtualization layer 504 ensures that each of the VMs currently executing within the virtual environment receive a fair allocation of underlying hardware devices and that all VMs receive sufficient devices to progress in execution. The virtualization layer 504 may differ for different guest operating systems. For example, the virtualization layer is generally able to provide virtual hardware interfaces for a variety of different types of computer hardware. This allows, as one example, a VM that includes a guest operating system designed for a particular computer architecture to run on hardware of a different architecture. The number of VMs need not be equal to the number of physical processors or even a multiple of the number of processors.
The virtualization layer 504 includes a virtualmachinemonitor module 518 (“VMM”) that virtualizes physical processors in the hardware layer to create virtual processors on which each of the VMs executes. For execution efficiency, the virtualization layer attempts to allow VMs to directly execute nonprivileged instructions and to directly access nonprivileged registers and memory. However, when the guest operating system within a VM accesses virtual privileged instructions, virtual privileged registers, and virtual privileged memory through the virtualization layer 504, the accesses result in execution of virtualizationlayer code to simulate or emulate the privileged devices. The virtualization layer additionally includes a kernel module 520 that manages memory, communications, and datastorage machine devices on behalf of executing VMs (“VM kernel”). The VM kernel, for example, maintains shadow page tables on each VM so that hardwarelevel virtualmemory facilities can be used to process memory accesses. The VM kernel additionally includes routines that implement virtual communications and datastorage devices as well as device drivers that directly control the operation of underlying hardware communications and datastorage devices. Similarly, the VM kernel virtualizes various other types of I/O devices, including keyboards, opticaldisk drives, and other such devices. The virtualization layer 504 essentially schedules execution of VMs much like an operating system schedules execution of application programs, so that the VMs each execute within a complete and fully functional virtual hardware layer.
FIG. 5B shows a second type of virtualization. In FIG. 5B, the computer system 540 includes the same hardware layer 542 and operating system layer 544 as the hardware layer 402 and the operating system layer 404 shown in FIG. 4. Several application programs 546 and 548 are shown running in the execution environment provided by the operating system 544. In addition, a virtualization layer 550 is also provided, in computer 540, but, unlike the virtualization layer 504 discussed with reference to FIG. 5A, virtualization layer 550 is layered above the operating system 544, referred to as the “host OS,” and uses the operating system interface to access operatingsystemprovided functionality as well as the hardware. The virtualization layer 550 comprises primarily a VMM and a hardwarelike interface 552, similar to hardwarelike interface 508 in FIG. 5A. The hardwarelayer interface 552, equivalent to interface 416 in FIG. 4, provides an execution environment for a number of VMs 556558, each including one or more application programs or other higherlevel computational entities packaged together with a guest operating system.
In FIGS. 5A5B, the layers are somewhat simplified for clarity of illustration. For example, portions of the virtualization layer 550 may reside within the hostoperatingsystem kernel, such as a specialized driver incorporated into the host operating system to facilitate hardware access by the virtualization layer.
It should be noted that virtual hardware layers, virtualization layers, and guest operating systems are all physical entities that are implemented by computer instructions stored in physical datastorage devices, including electronic memories, massstorage devices, optical disks, magnetic disks, and other such devices. The term “virtual” does not, in any way, imply that virtual hardware layers, virtualization layers, and guest operating systems are abstract or intangible. Virtual hardware layers, virtualization layers, and guest operating systems execute on physical processors of physical computer systems and control operation of the physical computer systems, including operations that alter the physical states of physical devices, including electronic memories and massstorage devices. They are as physical and tangible as any other component of a computer since, such as power supplies, controllers, processors, busses, and datastorage devices.
A VM or virtual application, described below, is encapsulated within a data package for transmission, distribution, and loading into a virtualexecution environment. One public standard for virtualmachine encapsulation is referred to as the “open virtualization format” (“OVF”). The OVF standard specifies a format for digitally encoding a VM within one or more data files. FIG. 6 shows an OVF package. An OVF package 602 includes an OVF descriptor 604, an OVF manifest 606, an OVF certificate 608, one or more diskimage files 610611, and one or more device files 612614. The OVF package can be encoded and stored as a single file or as a set of files. The OVF descriptor 604 is an XML document 620 that includes a hierarchical set of elements, each demarcated by a beginning tag and an ending tag. The outermost, or highestlevel, element is the envelope element, demarcated by tags 622 and 623. The nextlevel element includes a reference element 626 that includes references to all files that are part of the OVF package, a disk section 628 that contains meta information about all of the virtual disks included in the OVF package, a network section 630 that includes meta information about all of the logical networks included in the OVF package, and a collection of virtualmachine configurations 632 which further includes hardware descriptions of each VM 634. There are many additional hierarchical levels and elements within a typical OVF descriptor. The OVF descriptor is thus a selfdescribing, XML file that describes the contents of an OVF package. The OVF manifest 606 is a list of cryptographichashfunctiongenerated digests 636 of the entire OVF package and of the various components of the OVF package. The OVF certificate 608 is an authentication certificate 640 that includes a digest of the manifest and that is cryptographically signed. Disk image files, such as disk image file 610, are digital encodings of the contents of virtual disks and device files 612 are digitally encoded content, such as operatingsystem images. A VM or a collection of VMs encapsulated together within a virtual application can thus be digitally encoded as one or more files within an OVF package that can be transmitted, distributed, and loaded using wellknown tools for transmitting, distributing, and loading files. A virtual appliance is a software service that is delivered as a complete software stack installed within one or more VMs that is encoded within an OVF package.
The advent of VMs and virtual environments has alleviated many of the difficulties and challenges associated with traditional generalpurpose computing. Machine and operatingsystem dependencies can be significantly reduced or entirely eliminated by packaging applications and operating systems together as VMs and virtual appliances that execute within virtual environments provided by virtualization layers running on many different types of computer hardware. A next level of abstraction, referred to as virtual data centers or virtual infrastructure, provide a datacenter interface to virtual data centers computationally constructed within physical data centers.
FIG. 7 shows virtual data centers provided as an abstraction of underlying physicaldatacenter hardware components. In FIG. 7, a physical data center 702 is shown below a virtualinterface plane 704. The physical data center consists of a virtualdatacenter management server computer 706 and any of various different computers, such as PC 708, on which a virtualdatacenter management interface may be displayed to system administrators and other users. The physical data center additionally includes generally large numbers of server computers, such as server computer 710, that are coupled together by local area networks, such as local area network 712 that directly interconnects server computer 710 and 714720 and a massstorage array 722. The physical data center shown in FIG. 7 includes three local area networks 712, 724, and 726 that each directly interconnects a bank of eight server computers and a massstorage array. The individual server computers, such as server computer 710, each includes a virtualization layer and runs multiple VMs. Different physical data centers may include many different types of computers, networks, datastorage systems and devices connected according to many different types of connection topologies. The virtualinterface plane 704, a logical abstraction layer shown by a plane in FIG. 7, abstracts the physical data center to a virtual data center comprising one or more device pools, such as device pools 730732, one or more virtual data stores, such as virtual data stores 734736, and one or more virtual networks. In certain implementations, the device pools abstract banks of server computers directly interconnected by a local area network.
The virtualdatacenter management interface allows provisioning and launching of VMs with respect to device pools, virtual data stores, and virtual networks, so that virtualdatacenter administrators need not be concerned with the identities of physicaldatacenter components used to execute particular VMs. Furthermore, the virtualdatacenter management server computer 706 includes functionality to migrate running VMs from one server computer to another in order to optimally or near optimally manage device allocation, provides fault tolerance, and high availability by migrating VMs to most effectively utilize underlying physical hardware devices, to replace VMs disabled by physical hardware problems and failures, and to ensure that multiple VMs supporting a highavailability virtual appliance are executing on multiple physical computer systems so that the services provided by the virtual appliance are continuously accessible, even when one of the multiple virtual appliances becomes compute bound, dataaccess bound, suspends execution, or fails. Thus, the virtual data center layer of abstraction provides a virtualdatacenter abstraction of physical data centers to simplify provisioning, launching, and maintenance of VMs and virtual appliances as well as to provide highlevel, distributed functionalities that involve pooling the devices of individual server computers and migrating VMs among server computers to achieve load balancing, fault tolerance, and high availability.
FIG. 8 shows virtualmachine components of a virtualdatacenter management server computer and physical server computers of a physical data center above which a virtualdatacenter interface is provided by the virtualdatacenter management server computer. The virtualdatacenter management server computer 802 and a virtualdatacenter database 804 comprise the physical components of the management component of the virtual data center. The virtualdatacenter management server computer 802 includes a hardware layer 806 and virtualization layer 808, and runs a virtualdatacenter managementserver VM 810 above the virtualization layer. Although shown as a single server computer in FIG. 8, the virtualdatacenter management server computer (“VDC management server”) may include two or more physical server computers that support multiple VDCmanagementserver virtual appliances. The virtualdatacenter managementserver VM 810 includes a managementinterface component 812, distributed services 814, core services 816, and a hostmanagement interface 818. The hostmanagement interface 818 is accessed from any of various computers, such as the PC 708 shown in FIG. 7. The hostmanagement interface 818 allows the virtualdatacenter administrator to configure a virtual data center, provision VMs, collect statistics and view log files for the virtual data center, and to carry out other, similar management tasks. The hostmanagement interface 818 interfaces to virtualdatacenter agents 824, 825, and 826 that execute as VMs within each of the server computers of the physical data center that is abstracted to a virtual data center by the VDC management server computer.
The distributed services 814 include a distributeddevice scheduler that assigns VMs to execute within particular physical server computers and that migrates VMs in order to most effectively make use of computational bandwidths, datastorage capacities, and network capacities of the physical data center. The distributed services 814 further include a highavailability service that replicates and migrates VMs in order to ensure that VMs continue to execute despite problems and failures experienced by physical hardware components. The distributed services 814 also include a livevirtualmachine migration service that temporarily halts execution of a VM, encapsulates the VM in an OVF package, transmits the OVF package to a different physical server computer, and restarts the VM on the different physical server computer from a virtualmachine state recorded when execution of the VM was halted. The distributed services 814 also include a distributed backup service that provides centralized virtualmachine backup and restore.
The core services 816 provided by the VDC management server VM 810 include host configuration, virtualmachine configuration, virtualmachine provisioning, generation of virtualdatacenter alerts and events, ongoing event logging and statistics collection, a task scheduler, and a devicemanagement module. Each physical server computers 820822 also includes a hostagent VM 828830 through which the virtualization layer can be accessed via a virtualinfrastructure application programming interface (“API”). This interface allows a remote administrator or user to manage an individual server computer through the infrastructure API. The virtualdatacenter agents 824826 access virtualizationlayer server information through the host agents. The virtualdatacenter agents are primarily responsible for offloading certain of the virtualdatacenter managementserver functions specific to a particular physical server to that physical server computer. The virtualdatacenter agents relay and enforce device allocations made by the VDC management server VM 810, relay virtualmachine provisioning and configurationchange commands to host agents, monitor and collect performance statistics, alerts, and events communicated to the virtualdatacenter agents by the local host agents through the interface API, and to carry out other, similar virtualdatamanagement tasks.
The virtualdatacenter abstraction provides a convenient and efficient level of abstraction for exposing the computational devices of a cloudcomputing facility to cloudcomputinginfrastructure users. A clouddirector management server exposes virtual devices of a cloudcomputing facility to cloudcomputinginfrastructure users. In addition, the cloud director introduces a multitenancy layer of abstraction, which partitions VDCs into tenantassociated VDCs that can each be allocated to a particular individual tenant or tenant organization, both referred to as a “tenant.” A given tenant can be provided one or more tenantassociated VDCs by a cloud director managing the multitenancy layer of abstraction within a cloudcomputing facility. The cloud services interface (308 in FIG. 3) exposes a virtualdatacenter management interface that abstracts the physical data center.
FIG. 9 shows a clouddirector level of abstraction. In FIG. 9, three different physical data centers 902904 are shown below planes representing the clouddirector layer of abstraction 906908. Above the planes representing the clouddirector level of abstraction, multitenant virtual data centers 910912 are shown. The devices of these multitenant virtual data centers are securely partitioned in order to provide secure virtual data centers to multiple tenants, or cloudservicesaccessing organizations. For example, a cloudservicesprovider virtual data center 910 is partitioned into four different tenantassociated virtualdata centers within a multitenant virtual data center for four different tenants 916919. Each multitenant virtual data center is managed by a cloud director comprising one or more clouddirector server computers 920922 and associated clouddirector databases 924926. Each clouddirector server computer or server computers runs a clouddirector virtual appliance 930 that includes a clouddirector management interface 932, a set of clouddirector services 934, and a virtualdatacenter managementserver interface 936. The clouddirector services include an interface and tools for provisioning multitenant virtual data center virtual data centers on behalf of tenants, tools and interfaces for configuring and managing tenant organizations, tools and services for organization of virtual data centers and tenantassociated virtual data centers within the multitenant virtual data center, services associated with template and media catalogs, and provisioning of virtualization networks from a network pool. Templates are VMs that each contains an OS and/or one or more VMs containing applications. A template may include much of the detailed contents of VMs and virtual appliances that are encoded within OVF packages, so that the task of configuring a VM or virtual appliance is significantly simplified, requiring only deployment of one OVF package. These templates are stored in catalogs within a tenant'"'"'s virtualdata center. These catalogs are used for developing and staging new virtual appliances and published catalogs are used for sharing templates in virtual appliances across organizations. Catalogs may include OS images and other information relevant to construction, distribution, and provisioning of virtual appliances.
Considering FIGS. 7 and 9, the VDCserver and clouddirector layers of abstraction can be seen, as discussed above, to facilitate employment of the virtualdatacenter concept within private and public clouds. However, this level of abstraction does not fully facilitate aggregation of singletenant and multitenant virtual data centers into heterogeneous or homogeneous aggregations of cloudcomputing facilities.
FIG. 10 shows virtualcloudconnector nodes (“VCC nodes”) and a VCC server, components of a distributed system that provides multicloud aggregation and that includes a cloudconnector server and cloudconnector nodes that cooperate to provide services that are distributed across multiple clouds. VMware vCloud™ VCC servers and nodes are one example of VCC server and nodes. In FIG. 10, seven different cloudcomputing facilities are shown 10021008. Cloudcomputing facility 1002 is a private multitenant cloud with a cloud director 1010 that interfaces to a VDC management server 1012 to provide a multitenant private cloud comprising multiple tenantassociated virtual data centers. The remaining cloudcomputing facilities 10031008 may be either public or private cloudcomputing facilities and may be singletenant virtual data centers, such as virtual data centers 1003 and 1006, multitenant virtual data centers, such as multitenant virtual data centers 1004 and 10071008, or any of various different kinds of thirdparty cloudservices facilities, such as thirdparty cloudservices facility 1005. An additional component, the VCC server 1014, acting as a controller is included in the private cloudcomputing facility 1002 and interfaces to a VCC node 1016 that runs as a virtual appliance within the cloud director 1010. A VCC server may also run as a virtual appliance within a VDC management server that manages a singletenant private cloud. The VCC server 1014 additionally interfaces, through the Internet, to VCC node virtual appliances executing within remote VDC management servers, remote cloud directors, or within the thirdparty cloud services 10181023. The VCC server provides a VCC server interface that can be displayed on a local or remote terminal, PC, or other computer system 1026 to allow a cloudaggregation administrator or other user to access VCCserverprovided aggregatecloud distributed services. In general, the cloudcomputing facilities that together form a multiplecloudcomputing aggregation through distributed services provided by the VCC server and VCC nodes are geographically and operationally distinct.
Containers and Containers Supported by Virtualization Layers
As mentioned above, while the virtualmachinebased virtualization layers, described in the previous subsection, have received widespread adoption and use in a variety of different environments, from personal computers to enormous distributed computing systems, traditional virtualization technologies are associated with computational overheads. While these computational overheads have steadily decreased, over the years, and often represent ten percent or less of the total computational bandwidth consumed by an application running above a guest operating system in a virtualized environment, traditional virtualization technologies nonetheless involve computational costs in return for the power and flexibility that they provide.
While a traditional virtualization layer can simulate the hardware interface expected by any of many different operating systems, OSL virtualization essentially provides a secure partition of the execution environment provided by a particular operating system. As one example, OSL virtualization provides a file system to each container, but the file system provided to the container is essentially a view of a partition of the general file system provided by the underlying operating system of the host. In essence, OSL virtualization uses operatingsystem features, such as namespace isolation, to isolate each container from the other containers running on the same host. In other words, namespace isolation ensures that each application is executed within the execution environment provided by a container to be isolated from applications executing within the execution environments provided by the other containers. A container cannot access files not included the container'"'"'s namespace and cannot interact with applications running in other containers. As a result, a container can be booted up much faster than a VM, because the container uses operatingsystemkernel features that are already available and functioning within the host. Furthermore, the containers share computational bandwidth, memory, network bandwidth, and other computational resources provided by the operating system, without the overhead associated with computational resources allocated to VMs and virtualization layers. Again, however, OSL virtualization does not provide many desirable features of traditional virtualization. As mentioned above, OSL virtualization does not provide a way to run different types of operating systems for different groups of containers within the same host and OSLvirtualization does not provide for live migration of containers between hosts, highavailability functionality, distributed resource scheduling, and other computational functionality provided by traditional virtualization technologies.
FIG. 11 shows an example server computer used to host three containers. As discussed above with reference to FIG. 4, an operating system layer 404 runs above the hardware 402 of the host computer. The operating system provides an interface, for higherlevel computational entities, that includes a systemcall interface 428 and the nonprivileged instructions, memory addresses, and registers 426 provided by the hardware layer 402. However, unlike in FIG. 4, in which applications run directly above the operating system layer 404, OSL virtualization involves an OSL virtualization layer 1102 that provides operatingsystem interfaces 11041106 to each of the containers 11081110. The containers, in turn, provide an execution environment for an application that runs within the execution environment provided by container 1108. The container can be thought of as a partition of the resources generally available to higherlevel computational entities through the operating system interface 430.
FIG. 12 shows an approach to implementing the containers on a VM. FIG. 12 shows a host computer similar to that shown in FIG. 5A, discussed above. The host computer includes a hardware layer 502 and a virtualization layer 504 that provides a virtual hardware interface 508 to a guest operating system 1102. Unlike in FIG. 5A, the guest operating system interfaces to an OSLvirtualization layer 1104 that provides container execution environments 12061208 to multiple application programs.
Note that, although only a single guest operating system and OSL virtualization layer are shown in FIG. 12, a single virtualized host system can run multiple different guest operating systems within multiple VMs, each of which supports one or more OSLvirtualization containers. A virtualized, distributed computing system that uses guest operating systems running within VMs to support OSLvirtualization layers to provide containers for running applications is referred to, in the following discussion, as a “hybrid virtualized distributed computing system.”
Running containers above a guest operating system within a VM provides advantages of traditional virtualization in addition to the advantages of OSL virtualization. Containers can be quickly booted in order to provide additional execution environments and associated resources for additional application instances. The resources available to the guest operating system are efficiently partitioned among the containers provided by the OSLvirtualization layer 1204 in FIG. 12, because there is almost no additional computational overhead associated with containerbased partitioning of computational resources. However, many of the powerful and flexible features of the traditional virtualization technology can be applied to VMs in which containers run above guest operating systems, including live migration from one host to another, various types of highavailability and distributed resource scheduling, and other such features. Containers provide sharebased allocation of computational resources to groups of applications with guaranteed isolation of applications in one container from applications in the remaining containers executing above a guest operating system. Moreover, resource allocation can be modified at run time between containers. The traditional virtualization layer provides for flexible and scaling over large numbers of hosts within large distributed computing systems and a simple approach to operatingsystem upgrades and patches. Thus, the use of OSL virtualization above traditional virtualization in a hybrid virtualized distributed computing system, as shown in FIG. 12, provides many of the advantages of both a traditional virtualization layer and the advantages of OSL virtualization.
Method and System to Proactively Manage Resources in a Distributed Computing System
FIG. 13A shows an example of a virtualization layer 1302 located above a physical data center 1304. The virtualization layer 1302 is separated from the physical data center 1304 by a virtualinterface plane 1306. The physical data center 1304 comprises a management server computer 1308 and any of various computers, such as PC 1310, on which a virtualdatacenter management interface may be displayed to system administrators and other users. The physical data center 1304 additionally includes many server computers, such as server computers 13121319, that are coupled together by local area networks 13201322. In the example of FIG. 13A, each local area network directly interconnects a bank of eight server computers and a massstorage array. For example, local area network 1320 directly interconnects server computers 13121319 and a massstorage array 1324. Different physical data centers may be composed of many different types of computers, networks, datastorage systems and devices connected according to many different types of connection topologies. In the example of FIG. 13, the virtualization layer 1302 includes six virtual objects represented by N_{1}, N_{2}, N_{3}, N_{4}, N_{5}, and N_{6}. A virtual object can be an application, a VM, or a container. The virtual objects are hosted by four server computers 1314, 1326, 1328, and 1330. For example, virtual objects N_{1 }and N_{2 }are hosted by server computer 1326. The virtualization layer 1302 includes virtual data stores 1332 and 1334 that provide virtual storage for the virtual objects.
FIG. 13A also shows a management system 1336 abstracted to the virtualization layer 1302. The management system 1336 is hosted by the management server computer 1308. The management system 1336 includes an information technology (“IT”) operations management server, such as VMware'"'"'s vRealize® Operations™. The management system 1336 monitors usage, performance, and capacity of physical resources of each computer system, datastorage device, server computer and other components of the physical data center 1304. The physical resources include processors, memory, network connections, and storage of each computer system, massstorage devices, and other components of the physical data center 1304. The management system 1336 monitors physical resources by collecting streams of time series metric data, also called “streams of metric data” or “metric data streams,” sent from operating systems, guest operating systems, and other metric data sources running on the server computers, computer systems, network devices, and massstorage devices.
FIG. 13B shows the management system 1336 receiving streams of metric data represented by directional arrows 13381342. The streams of metric data include CPU usage, amount of memory, network throughput, network traffic, and amount of storage. CPU usage is a measure of CPU time used to process instructions of an application program or operating system as a percentage of CPU capacity. High CPU usage may be an indication of unusually large demand for processing power, such as when an application program enters an infinite loop. Amount of memory is the amount of memory (e.g., GBs) a computer system or other device uses at a given time. Network throughput is the number of bits of data transmitted to and from a server computer or datastorage device and is often recorded in megabits, kilobits or simply bits per second. Network traffic at a server computer or massstorage array is a count of the number of data packets received and sent at a given time. Clusters of server computers may also send collective metric data to the management system 1336. For example, a cluster of server computers 13121319 sends streams of cluster metric data, such as total CPU usage, total amount of memory, total network throughput, and total network traffic, used by the cluster to the management system 1336. Metric data may also be sent from the virtual objects and clusters of virtual objects to the management system 1336. The metric data may represent usage of virtual resources, such as virtual CPU and virtual memory.
FIG. 14A14D show plots of four different example streams of metric data. Horizontal axes, such as axis 1402, represents time. Vertical axes, such as vertical axis 1404, represents a range of metric data amplitudes. In FIGS. 14A14C, curves represent four examples of different patterns of metric data streams. For example, in FIG. 14A, curve 1406 represents a periodic stream of metric data in which the pattern of metric data in time interval 1408 is repeated. In FIG. 14B, curve 1410 represents a trendy stream of metric data in which the amplitude of the metric data generally increases with increasing time. In FIG. 14C, curve 1412 represents a nontrendy, nonperiodic stream of metric data. In FIG. 14D, rectangles 14141417 represent pulse waves of a pulsed stream of metric data generated by a resource that is utilized periodically and only for the duration of each pulse. The example streams of time series metric data shown in FIGS. 14A14D represent usage of different resources. For example, the metric data in FIG. 14A may represent CPU usage of a core in a multicore processor of a server computer over time. The metric data in FIG. 14B may represent the amount of virtual memory a VM uses over time. The metric data in FIG. 14C may represent network throughput for a cluster of server computers.
In FIGS. 14A14D, the streams of metric data are represented by continuous curves. In practice, a stream of metric data comprises a sequence of discrete metric data values in which each numerical value is recorded in a datastorage device with a time stamp. FIG. 14A includes a magnified view 1418 of three consecutive metric data points represented by points. Points represent amplitudes of metric data points at corresponding time stamps. For example, points 14201422 represents consecutive metric data values (i.e., amplitudes) z_{k−1}, z_{k}, and z_{k+1 }recorded in a datastorage device at corresponding time stamps t_{k−1}, t_{k}, and t_{k+1}, where subscript k is an integer time index of the kth metric data point in the stream of metric data.
FIG. 15 shows an architecture of an example metric data analytics system 1500 that may be implemented as part of the management system 1336. The analytics system 1500 comprises an analytics services manager 1502, a forecast engine 1504, and a metric data stream database 1506. The analytics services manager 1502 receives streams of metric data represented by directional arrows, such as directional arrow 1508. The forecast engine 1502 host a collection of metric processors, such as metric processors 15101512. The forecast engine 1504 provides a library of configurable models. The forecast engine 1504 includes an interface that enables a user to create one or more metric processors from the configurable models described below and assigns to each metric processor a single stream of metric data. Each metric processor is registered with a registration key that the analytical services manager 1502 uses to route a stream of metric data associate with a physical resource to a corresponding metric processor. Each stream of metric data is copied to the database 1506 to create a history for each resource. Each metric processor generates a forecast when the metric processor receives a forecast request sent by a user or when the metric processor receives a forecast request from a client, such as a workload placement application 1514, a capacity planning application 1516, or any other application 1518 that uses forecasted metric data.
FIG. 16 shows an example implementation of the analytics services manager 1502. Each metric processor is registered with a resource key in the analytics services manager 1502. Each data point of a stream of metric data comprises a resource key, time stamp, and a metric data value. The analytics services manager 1502 utilizes the resource key to route the stream of metric data to the metric processor associated with the resource key. In the example of FIG. 16, a series of decision blocks 16011603 represent operations in which the resource key of each stream of metric data received by the analytics services manager 1502 is checked against the resource keys of registered metric processors. Blocks 16041606 represent forwarding operations that correspond to the decision blocks 16011603 in which a metric data stream with a resource key that matches one of the registered registration keys is forwarded to one of the corresponding metric processors 15101512 of the forecast engine 1504. For example, FIG. 16 shows an example stream of metric data 1608 with a resource key denoted by “ResourceKey2” input to the analytics services manager 1502. The resource key is checked against the registered resource keys maintained by the analytics services manager 1502. Because the resource key “ResourceKey2” matches the registered resource key represented by block 1602, control flows to block 1605 in which the stream of metric data is forwarded to corresponding metric processor 1511. The stream of metric data may also be copied to the database 1506.
The analytics services manager 1502 also manages the life cycle of each metric processor. The analytics service manager 1502 can tear down a metric processor when requested by a user and may reconstruct a metric processor when instructed by a user by resetting and replaying an historical stream of metric data stored in the database 1506.
Each metric processor updates and constructs models of metric data behavior based on a stream of metric data. The models are used to create metric data forecasts when a request for a forecast is made. As a result, each metric processor generates a real time metric data forecast in response to a forecast request. In order to generate a real time metric data forecast, each metric processors maintains the latest statistics on the corresponding stream of metric data, updates model parameters as metric data is received, and maintains a limited history of metric data. The duration of the sequence of metric data values comprising a limited history may vary, depending on the resource. For example, when the resource is a CPU or memory of single server computer, the limited history of metric comprise a sequence collected over an hour, day, or a week. On the other hand, when the resource is CPU usage or memory of an entire cluster of server computers that run a data center tenant'"'"'s applications, the limited history of metric may comprise a sequence collected over days, weeks, or months. By updating the models, statistics, and maintaining only a limited history of the metric data, each metric processor utilizes a bounded memory footprint, a relatively small computational load, and computes a metric data forecast at low computational costs.
Metric data points of a metric data stream may arrive at the analytics services manager 1502 one at a time or two or more metric data points may arrive in time intervals. FIG. 17 shows an example of a limited history of metric data maintained by a metric processor 1702 of the forecast engine 1502. Plot 1704 displays data points of a limited history of metric data maintained by the metric processor 1702. For example, point 1706 represents a recently forwarded metric data value of the limited history of metric data recorded in a datastorage device 1710. The limited history of metric data is contained in a historical window 1708 of duration D. The historical window 1708 contains a sequence of metric data with time stamps in a time interval [t_{n}−D, t_{n}], where subscript n is a positive integer time index, and t, is the time stamp of the most recently received metric data value z_{n }added to the limited history and in the historical window. Ideally, consecutive metric data values forwarded to the metric processor 1702 have regularly spaced time stamps with no gaps. Interpolation is used to fill in any gaps or missing metric data in the limited history of metric data. For example, squareshaped metric data point 1712 represents an interpolated metric data value in the limited history of metric data. Interpolation techniques that may be used to fill in missing metric data values include linear interpolation, polynomial interpolation, and spline interpolation. The metric processor 1702 computes statistical information and forecast model parameters based on the limited history of metric data 1704 and records the statistical information and forecast model parameters in the datastorage device 1710. The historical window 1708 advances in time to include the most recently received metric data values and discard a corresponding number of the oldest metric data values from the limited history of metric data. Plot 1714 displays data points of an updated limited history of metric data. Points 1716 and 1718 represents two recently received metric data values added to the limited history of metric data and points 1720 and 1722 that represent the oldest metric data values outside the historical window 1708 are discarded. The metric data in the historical window 1708 are called “lags” and a time stamp of a lag is called “lag time.” For example, metric data values z_{n−1 }and z_{n }in the historical window are called lags and the corresponding time stamps values t_{n−1 }and t_{n }and called lag times. The metric processor 1702 computes statistical information and updates model parameters stored in the datastorage device 1710 based on the latest limited history of metric data 1704.
When a forecast request is received by the metric processor 1702, the metric processor 1702 computes a metric data forecast based on the latest model parameters. The metric processor 1702 computes forecasted metric data values in a forecast interval at regularly spaced lead time stamps represented by open points. FIG. 17 shows a plot of forecasted metric data 1724 represented by open points, such as open point 1726, appended to the latest limited history of metric data. For example, a first forecasted metric data value {tilde over (z)}_{n+1 }occurs at lead time stamp t_{n+1}, where “˜” denotes a forecast metric data value.
Each metric data value in a stream of metric data may be decomposed as follows:
z_{i}=T_{i}+A_{i}+S_{i} (1)
where
i=1, . . . , n;
n is the number of metric data values in the historical window;
T_{i }is the trend component;
A_{i }is the stochastic component; and
S_{i }is the seasonal or periodic component.
Note that certain streams of metric data may have only one component (e.g., A_{l}≠0 and T_{l}=S_{i}=0, for all i). Other streams may have two components (e.g., A_{i}≠0, S_{l}≠0, and T_{i}=0, for all i). And still other streams may have all three components.
FIG. 18 shows an overview of example processing operations carried out by the metric processor 1720. The latest metric data 1714 within the historical window 1708 is input to the metric processor 1702. The historical window contains the latest sequence of metric data in the limited history. In block 1801, a trend estimate of the metric data in the historical window is computed. In decision block 1802, if the trend estimate fails to adequately fit the metric data in the historical window, the metric data is nontrendy. On the other hand, if the trend estimate adequately fits the sequence of metric data, the sequence of metric data in the historical window is trendy and control flows to block 1803 where the trend estimate is subtracted from the metric data to obtain detrended sequence of metric data over the historical window.
FIGS. 19A19C show an example of computing a trend estimate and detrending metric data within a historical window. In FIGS. 19A19C, horizontal axes, such as horizontal axis 1902, represent time. Vertical axes, such as vertical axis 1904, represent the amplitude range of the metric data in the historical window. In FIG. 19A, the values of the metric data represented by points, such as point 1906, vary over time, but a trend is recognizable by an overall increase in metric data values with increasing time. A linear trend may be estimated over the historical window by a linear equation given by:
T_{i}=α+βt_{i} (2a)
where
α is vertical axis intercept of the estimated trend;
β is the slope of the estimated trend;
i=1, . . . , n; and
n is the time index of the most recently added metric data value to sequence of metric data with a time stamp in the historical window.
The index i is the time index for time stamps in the historical window. The slope a and vertical axis intercept p of Equation (2a) may be determined by minimizing a weighted least squares equation given by:
$\begin{array}{cc}L=\sum _{i=1}^{n}\ue89e{{w}_{i}\ue8a0\left({z}_{i}\alpha \beta \ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89e{t}_{i}\right)}^{2}& \left(2\ue89eb\right)\end{array}$
where w_{i }is a normalized weight function.
Normalized weight functions w_{i }weight recent metric data values higher than older metric data values within the historical window. Examples of normalized weight functions that give more weight to more recently received metric data values within the historical window include w_{i}=e^{(in) }and w_{i}=i/n, for i=1, . . . , n. The slope parameter of Equation (2a) is computed as follows:
$\begin{array}{cc}\beta =\frac{\sum _{i=1}^{n}\ue89e{w}_{i}\ue8a0\left({t}_{i}{t}_{w}\right)\ue89e\left({z}_{i}{z}_{w}\right)}{\sum _{i=1}^{n}\ue89e{{w}_{i}\ue8a0\left({t}_{i}{t}_{w}\right)}^{2}}& \left(2\ue89ec\right)\\ \mathrm{where}& \phantom{\rule{0.3em}{0.3ex}}\\ {t}_{w}=\frac{\sum _{i=1}^{n}\ue89e{w}_{i}\ue89e{t}_{i}}{\sum _{i=1}^{n}\ue89e{w}_{i}}& \phantom{\rule{0.3em}{0.3ex}}\\ {z}_{w}=\frac{\sum _{i=1}^{n}\ue89e{w}_{i}\ue89e{z}_{i}}{\sum _{i=1}^{n}\ue89e{w}_{i}}& \phantom{\rule{0.3em}{0.3ex}}\end{array}$
The vertical axis intercept parameter of Equation (2a) is computed as follows:
α=z_{w}−βt_{w} (2d)
In other implementations, the weight function may be defined as w_{i}≡1.
A goodnessoffit parameter is computed as a measure of how well the trend estimate given by Equation (2a) fits the metric data values in the historical window:
$\begin{array}{cc}{R}^{2}=\frac{\sum _{i=1}^{n}\ue89e{\left({T}_{i}{z}_{w}\right)}^{2}}{\sum _{i=1}^{n}\ue89e{\left({z}_{i}{z}_{w}\right)}^{2}}& \left(3\right)\end{array}$
The goodnessoffit R^{2 }ranges between 0 and 1. The closer R^{2 }is to 1, the closer linear Equation (2a) is to accurately estimating a linear trend in the metric data of the historical window. In decision block 1802 of FIG. 18, when R^{2}<Th_{trend}, where Th_{trend }is a user defined trend threshold less than 1, the estimated trend of Equation (2a) is not a good fit to the sequence of metric data values and the sequence of metric data in the historical window is regarded as nontrendy metric data. On the other hand, when R^{2}>Th_{trend}, the estimated trend of Equation (2a) is recognized as a good fit to the sequence of metric data in the historical window and the trend estimate is subtracted from the metric data values. In other words, when R^{2}>Th_{trend}, for i=1, . . . , n, the trend estimate of Equation (2a) is subtracted from the sequence of metric data in the historical window to obtain detrended metric data values:
{circumflex over (z)}_{i}=z_{i}−T_{i} (4)
where the hat notation “{circumflex over ( )}” denotes nontrendy or detrended metric data values.
In FIG. 19B, dashed line 1908 represents an estimated trend of the sequence of metric data. The estimated trend is subtracted from the metric data values according to Equation (4) to obtain a detrended sequence of metric data shown in FIG. 19C. Although metric data values may vary stochastically within the historical window, with the trend removed as shown in FIG. 19C, the metric data is neither generally increasing nor decreasing for the duration of the historical window.
Returning to FIG. 18, as recently forwarded metric data values are input to the metric processor 1702 and a corresponding number of oldest metric data values are discarded from the historical window, as described above with reference to FIG. 17, the metric processor 1702 updates the slope and vertical axis intercepts according to Equations (2b) and (2c), computes a goodnessoffit parameter according to Equation (3), and, if a trend is present, subtracts the trend estimate according to Equation (4) to obtain a detrended sequence of metric data in the historical window. If no trend is present in the metric data of the historical window as determined by the goodnessoffit in Equation (3), the sequence of metric data in the historical window is nontrendy. In either case, the sequence of metric data output from the computational operations represented by blocks 18011803 is called a sequence of nontrendy metric data and each nontrendy metric data value is represented by
{circumflex over (z)}_{i}=A_{l}+S_{l} (5)
where i=1, . . . , n.
The mean of the nontrendy metric data in the historical window is given by:
${\mu}_{z}=\frac{1}{n}\ue89e\sum _{i=1}^{n}\ue89e{\hat{z}}_{i}$
When the metric data in the historical window has been detrended according to Equation (4) and R^{2}>Th_{trend}, the mean μ_{z}=0. On the other hand, when the metric data in the historical satisfies the condition R^{2}≤Th_{trend}, then it may be the case that the mean μ_{z}≠0.
In alternative implementations, computation of the goodnessoffit R^{2 }is omitted and the trend is computed according to Equations (2a)(2d) followed by subtraction of the trend from metric data in the historical window according to Equation (4). In this case, the mean of the metric data μ_{z }equals zero in the discussion below.
The sequence of detrended or nontrendy metric data may be either stationary or nonstationary metric data. Stationary nontrendy metric data varies over time in a stable manner about a fixed mean. Nonstationary nontrendy metric data, on the other hand, the mean is not fixed and varies over time. For a stationary sequence of nontrendy metric data, the stochastic process models 18041806 in FIG. 18 may be autoregressive movingaverage models 18061808 (“ARMA”) computed separately for the stationary sequence of metric data in the historical window. An ARMA model is represented, in general, by
ϕ(B){circumflex over (z)}_{n}=θ(B)a_{n} (6a)
where
B is a backward shift operator,
$\phi \ue8a0\left(B\right)=1\sum _{i=1}^{p}\ue89e{\phi}_{i}\ue89e{B}^{i}$
$\theta \ue8a0\left(B\right)=1\sum _{i=1}^{q}\ue89e{\theta}_{i}\ue89e{B}^{i}$
a_{n }is white noise;
ϕ_{i }is an ith autoregressive weight parameter,
θ_{i }is an ith movingaverage weight parameter,
p is the number of autoregressive terms called the “autoregressive order;” and
q is the number of movingaverage terms called the “movingaverage order,”
The backward shift operator is defined as B{circumflex over (z)}_{n}={circumflex over (z)}_{n−1 }and B^{i}{circumflex over (z)}_{n}={circumflex over (z)}_{n−1}. In expanded notation, the ARMA model is represented by
$\begin{array}{cc}{\hat{z}}_{n}=\sum _{i=1}^{p}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{ni}+{a}_{n}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{q}\ue89e{\theta}_{i}\ue89e{a}_{ni}& \left(6\ue89eb\right)\end{array}$
where Φ=1−ϕ_{1}− . . . −ϕ_{p}.
The white noise parameters a_{n }may be determined at each time stamp by randomly selecting a value from a fixed normal distribution with mean zero and nonzero variance. The autoregressive weight parameters are computed from the matrix equation:
$\begin{array}{cc}\stackrel{\rightharpoonup}{\phi}={P}^{1}\ue89e\stackrel{\rightharpoonup}{\rho}& \left(7\right)\\ \mathrm{where}& \phantom{\rule{0.3em}{0.3ex}}\\ \stackrel{\rightharpoonup}{\phi}=\left[\begin{array}{c}{\phi}_{1}\\ \vdots \\ {\phi}_{p}\end{array}\right];& \phantom{\rule{0.3em}{0.3ex}}\\ \stackrel{\rightharpoonup}{\rho}=\left[\begin{array}{c}{\rho}_{1}\\ \vdots \\ {\rho}_{p}\end{array}\right];\mathrm{and}& \phantom{\rule{0.3em}{0.3ex}}\\ {P}^{1}={\left[\begin{array}{cccc}1& {\rho}_{1}& \dots & {\rho}_{p1}\\ {\rho}_{1}& 1& \dots & {\rho}_{p2}\\ \vdots & \vdots & \ddots & \vdots \\ {\rho}_{p1}& {\rho}_{p2}& \dots & 1\end{array}\right]}^{1}& \phantom{\rule{0.3em}{0.3ex}}\end{array}$
The matrix elements are computed from the autocorrelation function given by:
$\begin{array}{cc}{\rho}_{k}=\frac{{\gamma}_{k}}{{\gamma}_{0}}& \left(8\right)\\ \mathrm{where}& \phantom{\rule{0.3em}{0.3ex}}\\ {\gamma}_{k}=\frac{1}{n}\ue89e\sum _{i=1}^{nk}\ue89e\left({\hat{z}}_{i}{\mu}_{z}\right)\ue89e\left({\hat{z}}_{i+k}{\mu}_{z}\right)& \phantom{\rule{0.3em}{0.3ex}}\\ {\gamma}_{0}=\frac{1}{n}\ue89e\sum _{i=1}^{n}\ue89e{\left({\hat{z}}_{i}{\mu}_{z}\right)}^{2}& \phantom{\rule{0.3em}{0.3ex}}\end{array}$
The movingaverage weight parameters may be computed using gradient descent. In the Example of FIG. 18, the metric processor 1702 computes three separate stochastic process models 18041806 for stationary sequence of nontrendy metric data in the latest historical window. For example, when the historical window of the sequence of nontrendy metric data is updated with recently received nontrendy metric data values, three sets of autoregressive and moving average weight parameters are computed for each the three ARMA models denoted by ARMA(p_{1}, q_{1}), ARMA(p_{2}, q_{2}), and ARMA(p_{3}, q_{3}).
FIG. 20 shows example weight parameters for three autoregressive movingaverage models ARMA(p_{1}, q_{1}), ARMA(p_{2}, q_{2}), and ARMA(p_{3}, q_{3}). Horizontal axis 2002 represents time. Vertical axis 2004 represents a range of amplitudes of a stationary sequence of nontrendy metric data. Points, such as point 2006, represent metric data values in a historical window. FIG. 20 includes plots of three example sets of autoregressive and moving average weight parameters 20102012 for three different autoregressive and movingaverage models. For example, ARMA model ARMA(p_{3}, q_{3}) 2012 comprises twelve autoregressive weight parameters and nine movingaverage weight parameters. The values of the autoregressive weight parameters and movingaverage weight parameters are computed for the stationary sequence of nontrendy metric data in the historical window. Positive and negative values of the autoregressive weight parameters and movingaverage weight parameters are represented by line segments that extend above and below corresponding horizontal axes 2014 and 2016 and are aligned in time with time stamps of the nontrendy metric data.
Prior to updating the stochastic process models, when a new metric data value z_{+1 }is received by the metric processor 1702, the new metric data value is detrended according to Equation (4) to obtained detrended metric value {circumflex over (z)}_{n+1 }and a corresponding estimated nontrendy metric data value {circumflex over (z)}_{n+1}^{(m) }is computed using each of the stochastic process models 18041806. For example, the estimated nontrendy metric data value {circumflex over (z)}_{n+1}^{(m) }may be computed using each of the ARMA models ARMA(p_{m}, q_{m}) as follows:
$\begin{array}{cc}{\hat{z}}_{n+1}^{\left(m\right)}=\sum _{i=1}^{{p}_{m}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n}+{a}_{n+1}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{m}}\ue89e{\theta}_{i}\ue89e{a}_{n}& \left(9\right)\end{array}$
where m=1, 2, 3.
Separate accumulated residual errors are computed for each stochastic model as new metric data values are received by the metric processor 1702 as follows:
$\begin{array}{cc}\mathrm{Error}\ue8a0\left({p}_{m},{q}_{m}\right)=\sum _{i=1}^{n}\ue89e{\left({\hat{z}}_{n+1}^{\left(m\right)}{\hat{z}}_{n+1}\right)}^{2}& \left(10\right)\end{array}$
where
{circumflex over (z)}_{n+1 }is a latest nontrendy metric data value received by the metric processor 1702 at time stamp t_{n+1};
{circumflex over (z)}_{n+1}^{(m) }is an estimated nontrendy metric data value computed using the ARMA model ARMA(p_{m}, q_{m}) at the time stamp t_{n+1}; and
({circumflex over (z)}_{n+1}^{(m)}−{circumflex over (z)}_{n+1})^{2 }is a residual error at the time stamp t_{n+1}.
After the accumulated residual error is computed, the limited history of metric data is updated as described above with reference to FIG. 17 and the parameters of the stochastic process models 18041806 are updated.
FIG. 21 shows an example of a latest nontrendy metric data value {circumflex over (z)}_{n+1}, received by the metric processor 1702 as represented by point 2106. Three candidate metric data values are separately computed using the three ARMA models ARMA(p_{1}, q_{1}), ARMA(p_{2}, q_{2}), and ARMA(p_{3}, q_{3}) as follows:
${\hat{z}}_{n+1}^{\left(1\right)}=\sum _{i=1}^{{p}_{1}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n}+{a}_{n+1}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{1}}\ue89e{\theta}_{i}\ue89e{a}_{n}$
${\hat{z}}_{n+1}^{\left(2\right)}=\sum _{i=1}^{{p}_{2}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n}+{a}_{n+1}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{2}}\ue89e{\theta}_{i}\ue89e{a}_{n}$
$\mathrm{and}$
${\hat{z}}_{n+1}^{\left(3\right)}=\sum _{i=1}^{{p}_{3}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n}+{a}_{n+1}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{3}}\ue89e{\theta}_{i}\ue89e{a}_{n}$
where the white noise a_{n+1 }is randomly selecting from the fixed normal distribution. FIG. 21 includes a magnified view 2108 of the latest nontrendy metric data value {circumflex over (z)}_{n+1}, 2106 received by the metric processor 1702 and three estimated nontrendy metric data values {circumflex over (z)}_{n+1}^{(1)}, {circumflex over (z)}_{n+1}^{(2) }and {circumflex over (z)}_{n+1}^{(3) }computed separately from the three ARMA models at the time stamp t_{n+1}. Directional arrows 20112013 represent differences in amplitudes between the latest nontrendy metric data value {circumflex over (z)}_{n+1 }2106 and the three estimated nontrendy metric data values {circumflex over (z)}_{n+1}^{(1)}, {circumflex over (z)}_{n+1}^{(2) }and {circumflex over (z)}_{n+1}^{(3)}. Accumulated residual errors are maintained for each of the ARMA models as follows:
$\mathrm{Error}\ue8a0\left({p}_{1},{q}_{1}\right)=\sum _{i=1}^{n}\ue89e{\left({\hat{z}}_{n+1}^{\left(1\right)}{\hat{z}}_{n+1}\right)}^{2}$
$\mathrm{Error}\ue8a0\left({p}_{2},{q}_{2}\right)=\sum _{i=1}^{n}\ue89e{\left({\hat{z}}_{n+1}^{\left(2\right)}{\hat{z}}_{n+1}\right)}^{2}$
$\mathrm{and}$
$\mathrm{Error}\ue8a0\left({p}_{3},{q}_{3}\right)=\sum _{i=1}^{n}\ue89e{\left({\hat{z}}_{n+1}^{\left(3\right)}{\hat{z}}_{n+1}\right)}^{2}$
Returning to FIG. 18, when a forecast is requested 1807 in block 1808, the accumulated residual errors of the stochastic models are compared and the stochastic process model with the smallest accumulated residual error is selected for forecasting. For example, the ARMA model ARMA(p_{m}, q_{m}) may be used to compute forecasted metric data values as follows:
$\begin{array}{cc}{\hat{z}}_{n+l}^{\left(m\right)}=\sum _{i=1}^{l1}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n+i1}^{\left(m\right)}+\sum _{i=l}^{{p}_{m}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n+li}+{a}_{n+l}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{m}}\ue89e{\theta}_{i}\ue89e{a}_{n+li}& \left(11\right)\end{array}$
where
i=1, . . . , L is a lead time index with L the number of lead time stamps in the forecast interval;
{circumflex over (z)}_{n}^{(m) }is zero; and
a_{n+1 }is the white noise for the lead time stamp t_{n+1}.
FIG. 22 shows forecasted metric data values computed using weight parameters of the ARMA model 2012 ARMA(p_{3}, q_{3}) in FIG. 20. In the example of FIG. 22, horizontal axis 2202 is a time axis for positive integer lead time indices denoted by 1. The first three forecasted metric data values, denoted by “x'"'"'s” in FIG. 22, are computed using ARMA(p_{3}, q_{3}) as follows:
${\hat{z}}_{n+1}^{\left(3\right)}=\sum _{i=1}^{{p}_{3}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n+1i}+{a}_{n+1}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{3}}\ue89e{\theta}_{i}\ue89e{a}_{n+li}$
${\hat{z}}_{n+2}^{\left(3\right)}={\phi}_{1}\ue89e{\hat{z}}_{n+1}^{\left(3\right)}+\sum _{i=1}^{{p}_{3}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n+2i}+{a}_{n+2}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{3}}\ue89e{\theta}_{i}\ue89e{a}_{n+li}$
$\mathrm{and}$
${\hat{z}}_{n+3}^{\left(3\right)}={\phi}_{1}\ue89e{\hat{z}}_{n+2}^{\left(3\right)}+{\phi}_{2}\ue89e{\hat{z}}_{n+1}^{\left(3\right)}+\sum _{i=3}^{{p}_{3}}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{n+3i}+{a}_{n+3}+{\mu}_{z}\ue89e\Phi +\sum _{i=1}^{{q}_{3}}\ue89e{\theta}_{i}\ue89e{a}_{n+li}.$
In still other implementations, the stochastic process models 18041806 in FIG. 18 may be implemented as autoregressive process (“AR”) models given by:
$\begin{array}{cc}{\hat{z}}_{n}=\sum _{i=1}^{p}\ue89e{\phi}_{i}\ue89e{\hat{z}}_{ni}+{a}_{n}+{\mu}_{z}\ue89e\Phi & \left(12\right)\end{array}$
The autoregressive process model is obtained by omitting the movingaverage weight parameters form the ARMA model. By omitting the movingaverage model, computation of the autoregressive weight parameters of the autoregressive model is less computationally expensive than computing the autoregressive and movingaverage weight parameters of the ARMA models. When the historical window of the sequence of nontrendy metric data is updated with recently received nontrendy metric data values, three sets of autoregressive weight parameters are computed for each the three AR models denoted by AR(p_{1}), AR(p_{2}), and AR(p_{3}). Accumulated residual errors are maintained for each of the AR models. Forecasted metric data values {circumflex over (z)}_{n+1}^{(m) }are computed for lead times using Equation (11) with the movingaverage weight parameters equal to zero and the AR model with smallest accumulated residual error at the time of the forecast request.
Unlike a stationary sequence of nontrendy metric data, a nonstationary sequence of nontrendy metric data does not vary over time in a stable manner about a fixed mean. In other words, a nonstationary sequence of nontrendy metric data behaves as the though the metric data values of the sequence have no fixed mean. In these situations, one or more of the stochastic process models 18041806 in FIG. 18 may be implemented using an autoregressive integrated movingaverage (“ARIMA”) model given by:
ϕ(B)∇_{d}{circumflex over (z)}_{n}=θ(B)a_{n} (13)
where ∇^{d}=(1−B)^{d}.
The ARIMA autoregressive weight parameters and moveaverage weight parameters are computed in the same manner as the parameters of the ARMA models described above. The ARIMA model, denoted by ARIMA(p_{1}, q_{1}), ARIMA(p_{2}, q_{2}), and ARIMA(p_{3}, q_{3}), with the smallest accumulated residual error at the time of the forecast request is used to compute forecasted metric data values {circumflex over (z)}_{n+1}^{(m) }for lead times in the forecast interval.
Returning to FIG. 18, certain streams of metric data may have pulse wave patterns. Other streams of metric data may have a single time varying periodic pattern or a combination of period patterns, such as hourly, daily, weekly or monthly periodic patterns, and are called “seasonal.” Other streams of metric data may not be periodic. Because pulse wave metric data is a special type of periodic data, in decision block 1809, edge detection is used to determine if the sequence of nontrendy metric data in the historical window is pulse wave metric data. If edge detection reveals that the metric data is pulse wave metric data, control flows to determining the pulse wave model 1810. Otherwise, control flows to block 1811 to determine if the metric data contains a seasonal pattern. Seasonality in a sequence of nontrendy metric data is a regular periodic pattern of amplitude changes that repeats in time periods. A seasonal period is determined in a seasonal model in block 1811.
FIG. 23 shows a plot of an example stream of metric data 2300. Horizontal axis 2302 represents time. Vertical axis 2304 represents a range of amplitudes for metric data values. The stream of metric data comprises pulses 23062310 separated by low amplitude time intervals 23112314. The stream of metric data may represent network traffic, memory usage, or CPU usage for a server computer that runs a periodically executed VM. The low amplitude time intervals 23112314 represent time intervals in which the VM is idle. Pulses 23062310 represent time intervals when the VM is running. This stream of metric data is an example of metric data modeled using a pulse wave model 1810.
FIG. 24 shows a plot of an example stream of metric data 2400 that exhibits two seasonal periods. Horizontal axis 2402 represents time. Vertical axis 2404 represents a range of amplitudes for metric data values. Oscillating curve 2406 represents a stream of metric data with two seasonal periods. A first longer seasonal period appears with regularly spaced larger amplitude oscillations 24062409 separated by regularly spaced smaller amplitude oscillations 24102413. A second shorter seasonal period exhibits oscillations over much shorter time intervals. This stream of metric data is an example of seasonal metric data modeled using the seasonal model 1811.
In block 1809 of FIG. 18, edge detection is applied to the metric data in the historical window. An exponentially weighted moving average (“EWMA”) of absolute differences between two consecutive nontrendy metric data values denoted by Δ_{i}={circumflex over (z)}_{i}−{circumflex over (z)}_{i−1} is maintained for i=1, . . . . n metric data values in the historical window. The EWMA for the latest time stamp t_{n }in the historical window is computed recursively by:
MA_{n}=αΔ_{n}+(1−α)MA_{n−1} (14a)
where
MA_{0}=0; and
0<α<1.
For example, the parameter α may be set 0.1, 0.2, or 0.3. For each new nontrendy metric data value {circumflex over (z)}_{n+1}, the absolute difference Δ_{n+1}={circumflex over (z)}_{n+1}−{circumflex over (z)}_{n} is computed. The new nontrendy metric data value {circumflex over (z)}_{n+1 }is a spike in the magnitude of the stream of metric data, when the absolute difference satisfies the following spike threshold condition:
Δ_{n+1}>Th_{spike} (14b)
where Th_{spike}=C×MA_{n}.
The parameter C is a numerical constant (e.g., C=4.0, 4.5, or 5.0). When the absolute difference Δ_{n+1 }is less than the spike threshold, control flows to seasonal model in block 1811 of FIG. 18. When the new nontrendy metric data value {circumflex over (z)}_{n+1 }satisfies the condition given by Equation (14b), edge detection is applied to determine if sequence of nontrendy metric data comprises pulse wave edges in a backward time window [{circumflex over (z)}_{n−X}, {circumflex over (z)}_{n}] and a forward time window [{circumflex over (z)}_{n}, {circumflex over (z)}_{n+X}], where X is a fixed number of metric data points.
FIGS. 25A25D shows edge detection applied to a sequence of metric data. Horizontal axes, such as horizontal axis 2502, represent time. Vertical axes, such as vertical axis 2504, represent a range of amplitudes for metric data values. In FIG. 25A, metric data with low amplitude metric data are located on both sides of a pulse 2506 of high amplitude metric data. Noise appears as smaller amplitude variations in metric data values.
A smoothing filter is applied to the metric data in the historical window to suppress the noise. The smoothing filter may be a moving median filter, a moving average filter, and a Gaussian filter. FIG. 25B shows smoothed amplitudes in the metric data of a smoothed pulse 2508 and smoothed amplitudes of metric data surrounding the pulse. Increasing edge 2510 and decreasing edge 2512 of the pulse 2508 appear near corresponding time stamps 2514 and 2516. Edges may be detected by first computing the gradient at each smoothed metric data value in the historical domain. For i=1, . . . , n, the gradient may be computed at each smoothed metric data value as follows:
G(t_{i})=−½{circumflex over (z)}_{i−1}^{s}+½z_{i+1}^{s} (15)
where {circumflex over (z)}_{i}^{s }is a smoothed metric data value in the historical domain.
After computing the gradient at each metric data value, other gradients around an edge may be large enough to obscure detection of actual edges of a pulse.
FIG. 25C shows a plot of example gradients of the metric data shown in FIG. 25B. Points 2518 and 2520 are positive gradient values that correspond to edge 2510 in FIG. 25B. Points 2522 and 2524 are negative gradient values that correspond to edge 2512 in FIG. 25B.
Nonmaximum edge suppression is applied to identify pulse edges by suppressing gradient values (i.e., setting gradient values to 0) except for local maxima gradients that correspond to edges in a pulse. Nonmaximum edge suppression is systematically applied in overlapping neighborhoods of consecutive gradients. For example, each neighborhood may contain three consecutive gradients. The magnitude of a central gradient in the neighborhood is compared with the magnitude of two other gradients in the neighborhood. If the magnitude of the central gradient is the largest of the three gradients in the neighborhood, the values of the other gradients are set to zero and the value of the central gradient is maintained. Otherwise, the gradient with the largest value is maintained while the value of the central gradient and the other gradient in the neighborhood are set to zero.
FIG. 25D shows a plot of gradients after applying nonmaximum edge suppression to the gradients shown in FIG. 25C. In FIG. 25D, point 2520 is a positive gradient at time stamp 2514 and corresponds to upward (“+”) edge 2510 and point 2522 is a negative gradient at time stamp 2516 and corresponds to downward (“−”) edge 2512. Positive gradient thresholds Th+ 2526 and negative gradient threshold Th− 2528 are used to identify the metric data values at time stamps 2514 and 2516 corresponding to a pulse. In this example, gradients 2520 and 2522 exceed corresponding gradient thresholds 2526 and 2528. As a result, amplitude 2530 at time stamp 2514 is identified as an upward edge of the pulse wave 2506 and amplitude 2532 at time stamp 2516 is identified as a downward edge of the pulse wave 2506. The output for each edge detection is denoted by (t_{s}, A, sign), where A is an amplitude of a pulse edge at time stamp t_{s}. The “sign” is a binary value, such as “0” for upward edges and “1” for downward edges.
Returning to FIG. 18, the pulse wave model 1810 estimates the pulse width and period for the pulse wave stream of metric data. The pulse width can be estimated as a difference in time between consecutive upward and downward edges. The period can be estimated as a difference in time between two consecutive upward (or downward) edges. FIG. 26A shows a plot of gradients of upward and downward edges of the pulses in the sequence of nontrendy metric data 2300 shown in FIG. 23. Positive gradients 26012605 exceed positive gradient threshold 2606. Negative gradients 26072611 exceed negative gradient threshold 2612. The gradients in FIG. 26A are used to designate edges of the sequence of nontrendy metric data 2300 shown in FIG. 23 as upward or downward edges. FIG. 26B shows pulse widths and periods of the stream of metric data 2300. Each edge has a corresponding 3tuple (t_{s}, A, sign). In FIG. 26B, pulse widths denoted by pw_{1}, pw_{2}, pw_{3}, pw_{4}, and pw_{5 }are computed as a difference between time stamps of consecutive upward and downward edges. Periods are denoted by p_{1}, p_{2}, p_{3}, p_{4}, and p_{5 }are computed as a difference between time stamps of two consecutive upward (or downward) edges. The latest pulse widths and periods are recorded in corresponding circular buffer backsliding histograms described below with reference to FIG. 30A.
Returning to FIG. 18, if the sequence of nontrendy metric data is not pulsewave metric data, the metric data may be seasonal metric data and a seasonal period is determined in seasonal model 1811. The seasonal model 1811, begins by applying a shorttime discrete Fourier transform (“DFT”) given by:
$\begin{array}{cc}Z\ue8a0\left(m,k/N\right)=\sum _{i=1}^{N}\ue89e{\hat{z}}_{i}\ue89ew\ue8a0\left(im\right)\ue89e\mathrm{exp}\ue8a0\left(j\ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89e2\ue89e\pi \ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89e\mathrm{ki}/N\right)& \left(16\right)\end{array}$
where
m is an integer time shift of a shorttime window;
j is the imaginary constant;
k=0, . . . , N−1 is a frequency spectrum sample;
N is the number of data points in a subset of the historical window (i.e., N≤n); and
w(i−m) is a window function.
The window function w(i−m) is function that tapers toward both ends of the shorttime window. For example, the window function can be a Hann function, a Hamming function, or Gaussian function. The spectrum Z(m, k/N) is a complex valued function of m and k. The power spectral density (“PSD”) is given by:
PSD(m,k/N)=[Z(m,k/N)]^{2} (17)
where
k=0, . . . , N/2;
${f}_{k}=\frac{2\ue89ek}{N}\ue89e{f}_{c};$
and
f_{c }is the Nyquist frequency.
The PSD is the power of the frequency spectrum at N/2+1 frequencies. The PSD values PSD(m, k/N) form a periodogram over a domain of frequency samples k (i.e., f_{k}) for each time shift m.
The shorttime DFT may be executed with a fast Fourier transform (“FFT”). Ideally, a highresolution FFT comprising a large window size and high sampling rate would be used to compute a PSD in each historical window of the FFT to provide complete frequency spectrum information in the historical window. By finding a maximum PSD point at each time shift m and curve fitting, various seasonal patterns and reconstructed metric data values can ideally be forecasted with an inverse FFT. However, computing a highresolution FFT and storing the full PSD for a sequence of nontrendy metric data is computationally expensive and time consuming in a resource constrained management system that already receives thousands of different streams of metric data and in which real time forecasts are needed to respond to rapidly to changing demands for computational resources in a distributed computing system.
Methods described herein avoid the slowdown created by a highresolution FFT by:
1) using an FFT in a shorttime window with a small number of metric data points (e.g., a shorttime window may have N=64, 128 or 256 sequential nontrendy metric data points of the limited history) for three different coarse sampling rates,
2) extracting a single principle frequency from each PSD and tracking a most recent mode of the principle frequency, and
3) performing a local autocorrelation function (“ACF”) search in the time domain to refine estimation of a principle period that corresponds to the principle frequency of the metric data to compensate for resolution lost with coarse sampling rates and spectral leakage.
The FFT is applied to subsequences of the sequence of nontrendy metric data, each subsequence comprising N metric data points sampled from the sequence of nontrendy metric data using a different sampling rate. Each subsequence of metric data points is searched for a periodic pattern. For example, the example sequence of nontrendy metric data 2400 shown in FIG. 24 appears to have a short periodic pattern and a longer periodic pattern as described above with reference to FIG. 24. The period determined for the shorter sampling rate has higher priority in forecasting than a period obtained for a longer sampling rate.
FIG. 27 shows a bar graph 2700 of three different examples of coarse sampling rates and associated with different subsequences of sampled from the same sequence of nontrendy metric data. Horizontal axis 2702 represent time in hours. Hashmarked bars 27042706 represent durations of three different sampling rates applied to the same stream of metric data to collect three different subsequences of nontrendy metric data over three different time intervals. Each subsequence contains N=64 sequential nontrendy metric data points. Plots 27082710 are example plots of subsequences of metric data sampled from the same sequence of nontrendy metric data over three different time intervals and the three different sampling rates. In plots 27082710, horizontal axes 27112712 represent different time intervals. Time zero along each axis represents the current time. In plot 2708, horizontal axis 2711 represents a time interval of 64 hours. Curve 2714 represents a subsequence of metric data sampled from the sequence of nontrendy metric data over a 64hour time interval at the sampling rate of 1 hour. In plot 2709, horizontal axis 2712 represents a time interval of 16 days. Curve 2718 represents a sequence of metric data sampled from the sequence of nontrendy metric data over a 16day time interval at the sampling rate of 6 hours. In plot 2710, horizontal axis 2713 represents a time interval of 64 days. Curve 2722 represents metric data sampled from the sequence of nontrendy metric data over a 64day time interval at the sampling rate of 24 hours. The different sampling rates applied to the same sequence of nontrendy metric data over different time intervals and at different sampling rates reveal different frequency patterns or seasonal periods. Subsequences of metric data 2714 and 2722 exhibit seasonal periods. Subsequence of metric data 2718 exhibits no discernible periodic pattern. If it is the case that different periods are present in the subsequences of metric data 2714 and 2722, the period for the subsequence of metric data 2714 is used to forecast metric data, because the period associated with the shorter sampling rate has higher priority in forecasting than the period associated with the longer sampling rate.
FIG. 28 shows an example of periodograms computed for a series of shorttime windows of a sequence of nontrendy metric data. In FIG. 28, horizontal axis 2802 represents time. Vertical axis 2804 represents a range of metric data amplitudes. Curve 2806 represents nontrendy metric data sampled at one of the three sampling rates. Brackets 28082811 represents the location of a moving overlapping shorttime window of nontrendy metric data as nontrendy metric data is received by the seasonal model 1811. For each shorttime window, an FFT is applied to a small number N of the latest metric data points followed by computation of a PSD. For example, shorttime window 2808 contains a subsequence of nontrendy metric data values up to a current time to. An FFT 2812 is applied to a the latest subsequence of metric data (e.g., N=64) in the shottime window 2808 followed by computation of a PSD 2814. As more metric data is received and sampled at the sampling rate, the FFT is applied to the subsequence of metric data in a current shorttime window followed by computation of a PSD. For example, shorttime window 2809 contains a subsequence of metric data up to a next current time t_{1}. An FFT 2816 is applied to the subsequence of latest metric data (e.g., N=64) in the shottime window 2809 followed by computation of a PSD 2818. FIG. 28 also shows example plots of periodograms 28202823 for each the PSDs computed from the subsequences of metric data in each of the corresponding shorttime windows 28082811. Axis 2826 represents a range of frequencies. Axis 2828 represents a range of time shifts. Axis 2830 represents a range of power.
For each periodogram, an approximate area of the periodogram is computed. For example, the approximate area of a periodogram can be computed using the Trapezoid Rule:
$\begin{array}{cc}{\mathrm{PSD}}_{\mathrm{Area}}=\frac{N}{2}\ue89e\sum _{i=1}^{N/2}\ue89e\left(\mathrm{PSD}\ue8a0\left(\frac{k1}{N}\right)\mathrm{PSD}\ue8a0\left(\frac{k}{N}\right)\right)& \left(18\right)\end{array}$
Other methods may be used to compute the area of a periodogram, such as Simpson'"'"'s rule and Romberg'"'"'s method. Candidate principle frequencies of a periodogram are identified from the approximate area of the periodogram using the following threshold condition:
$\begin{array}{cc}\underset{k}{\mathrm{argmax}}\ue89e\left\{\left(\mathrm{PSD}\ue8a0\left(\frac{k}{N}\right)*{K}_{\mathrm{trap}}\ue8a0\left(\frac{k}{N}\right)\right)\right\}>{\mathrm{Th}}_{\mathrm{princ}}*\sum _{k=0}^{N/2}\ue89e\mathrm{PSD}\ue8a0\left(\frac{k}{N}\right)& \left(19\right)\end{array}$
where
“*” means convolution;
Th_{prine}=PSD_{Area}/Q; and
${K}_{\mathrm{trap}}\ue8a0\left(\frac{k}{N}\right)={C}_{1}\ue89e\mathrm{PSD}\ue8a0\left(\frac{k1}{N}\right)+{C}_{2\ue89e\phantom{\rule{0.3em}{0.3ex}}}\ue89e\mathrm{PSD}\ue8a0\left(\frac{k}{N}\right)+{C}_{3}\ue89e\mathrm{PSD}\ue8a0\left(\frac{k+1}{N}\right)$
The parameter Q is a positive integer (e.g., Q=3, 4, or 5) and K_{trap}(k/N) is called a normalized threepoint trapezoid window. The parameters C_{1}, C_{2}, and C_{3 }are normalized to 1. For example, C_{1}=C_{3}=0.25 and C_{2}=0.5. If none of the frequencies of the periodogram satisfies the condition given by Equation (19), the subsequence of the sequence of nontrendy metric data does not have a principle frequency in the shorttime window of the FFT and is identified as nonperiodic.
FIG. 29A show a plot of the periodogram 2821 shown in FIG. 28. Horizontal axis 2902 represents a frequency spectrum sample domain. Vertical axis 2904 represents a power range. Curve 2906 represents the power spectrum present in the subsequence of metric data over a spectral domain of frequencies k/N. The area under the curve 2906 may be approximated by Equation (18). Dashed line 2908 represents the principle frequency threshold Th_{princ}. In this example, the periodogram reveals two strong peaks 2910 and 2912 above the threshold 2908 with corresponding frequencies k_{1}/N and k_{2}/N. However, which of the two peaks 2910 and 2912 is the principle frequency cannot be determined directly from the periodogram alone.
Each PSD value PSD(k/N) of a periodogram is the power in the spectral domain at a frequency k/N or equivalently at a period N/k in the time domain. Each DFT bin corresponds to a range of frequencies or periods. In particular, Z(k/N) bin corresponds to periods in the time interval
$\left[\frac{N}{k},\frac{N}{k1}\right).$
The accuracy of discovered candidate principle frequencies based on the periodogram deteriorates for large periods because of the increasing width of the DFT bins (N/k). In addition, spectral leakage causes frequencies that are not integer multiples of the DFT bin width to spread over the entire frequency spectrum. As a result, a periodogram may contain false candidate principle frequencies. However, a periodogram may provide a useful indicator of candidate principle frequencies.
In certain implementations, the principle frequency of the periodogram is determined by computing an autocorrelation function (“ACF”) within each neighborhood of candidate periods that correspond to candidate principle frequencies of the periodogram. The autocorrelation function over time lags r is given by:
$\begin{array}{cc}\mathrm{ACF}\ue8a0\left(\tau \right)=\frac{1}{N}\ue89e\sum _{i=1}^{N}\ue89e{\hat{z}}_{i}\ue89e{\hat{z}}_{i+\tau}& \left(20\right)\end{array}$
The ACF is timedomain convolution of the subsequence of nontrendy metric data values {circumflex over (z)}_{1 }in the shorttime window of the FFT. Given the candidate principle frequencies of the periodogram that satisfy the threshold requirements of the condition in Equation (19), the ACF is used to determine which of the corresponding candidate periods in the time domain is a valid principle period. A candidate period with an ACF value located near a local maximum of the ACF (i.e., located within a concavedown region) is a valid period. A candidate period with an ACF value located near a local minimum of the ACF (i.e., located within a concaveup region) is not a valid period and is discarded. For a period with an ACF value that lies on a concavedown region of the ACF, the period is refined by determining the period of a local maximum ACF value of the concavedown region. The period of the local maximum is the principle period used to forecast seasonal metric data.
FIG. 29B shows a plot of an example ACF that corresponds to the periodogram shown in FIG. 29A. Horizontal axis 2914 represents time. Vertical axis 2916 represents a range of ACF values. Dashed curve 2918 represents ACF values computed according to Equation (20) over a time interval Periods N/k_{1 }and N/k_{2 }represent candidate periods that correspond to candidate principle frequencies k_{2}/N and k_{1}/N in FIG. 29A. Open points 2920 and 2922 are ACF values at candidate periods N/k_{1 }and N/k_{z}. Rather than computing the full ACF represented by dashed curve 2918 over a large time interval, in practice, the ACF may be computed in smaller neighborhoods 2924 and 2926 of the candidate periods as represented by solid curves 2928 and 2930. The ACF value 2922 is located on a concavedown region of the ACF and corresponds to the largest of the two candidate principle frequencies. The other ACF value 2920 is located on a concaveup region of the ACF and corresponds to the smallest of the two candidate principle frequencies.
A neighborhood centered at the candidate period N/k is represented by:
$\begin{array}{cc}{\mathrm{NBH}}_{N/k}=\left[a,\dots \ue89e\phantom{\rule{0.8em}{0.8ex}},\frac{N}{k},\dots \ue89e\phantom{\rule{0.6em}{0.6ex}},b\right]& \left(21\right)\end{array}$
In certain implementations, the end points for the neighborhoods may be given by:
$a=\frac{1}{2}\ue89e\left(\frac{N}{k+1}+\frac{N}{k}\right)1$
$\mathrm{and}$
$b=\frac{1}{2}\ue89e\left(\frac{N}{k}+\frac{N}{k1}\right)+1$
The upward or downward curvature of the ACF in the neighborhood of a candidate period is determined by computing a linear regression model for a sequence of points t between the endpoints of the neighborhood NBH_{N}/k. A split period within the search interval R_{N/k }is obtained by minimizing a local approximation error for two line segments obtained from linear regression as follows:
$\begin{array}{cc}{t}_{\mathrm{split}}=\mathrm{arg}\ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89e\underset{P}{\mathrm{min}}\ue89e\left(\mathrm{error}\ue8a0\left(S\ue8a0\left(a,t\right)\right)+\mathrm{error}\ue8a0\left(S\ue8a0\left(t+1,b\right)\right)\right)& \left(22\right)\end{array}$
where
i is point in the neighborhood NBH_{N/k};
S(a, t) is a first line segment fit to points between point a and point t of the search interval NBH_{N/k};
S(t+1, b) is a second line segment fit to points between point t+1 and point b of the search interval NBH_{N/k};
error(S(a, t)) is the error between the S(a, t) and ACF values between point a and point t; and
error(S(t+1, b)) is the error between S(t+1, b) and ACF values between point t+1 and point b.
If the slopes of the first line segment S(a, t_{split}) and the second line segment S(t_{split}+1, b) are correspondingly negative and positive, then the ACF value is in a concaveup region of the ACF and the corresponding period is discarded. If the slopes of the first line segment S(a, t_{split}) and second line segment S(t_{split}+1, b) are correspondingly positive and negative, then the ACF value is in a concavedown region of the ACF and the corresponding candidate period is kept. Once a candidate period of a concavedown region has been identified, the local maximum ACF may be located at the end point of the first line segment S(a, t_{split}) or located at the start point of the second line segment S(t_{split}+1, b). Alternatively, a hillclimbing technique, such as gradient ascent, is applied to determine the local maximum ACF of the concavedown region. The period that corresponds to the ACF local maximum is the principle period and is seasonal parameter used to forecast seasonal metric data over a forecast interval.
FIG. 29C shows examples of line segments computed from ACF values in the neighborhoods 2924 and 2926. First and second line segments 2932 and 2934 in the neighborhood 2924 have negative and positive slopes, respectively. As a result, the candidate period N/k_{2 }is in a concaveup region of the ACF and is discarded. On the other hand, first and second line segments 2936 and 2938 in the neighborhood 2926 have positive and negative slopes, respectively. As a result, the candidate period N/k_{1 }is in a concavedown region of the ACF. The local maximum 2940 with principle period N/k′ may be at the end of the first line segment or beginning of the second line segment or determined by applying a hillclimbing technique. The principle period is a seasonal parameter.
In other implementations, rather than checking each candidate period of the candidate frequencies that satisfy the condition in Equation (19) in neighborhoods of the ACF, only the candidate period that corresponds to the largest candidate principle frequency is checked using the ACF to determine if the candidate period is a principle period.
Recent mode tracking may be used to determine robust periodic model parameter estimates. Recent mode tracking is implemented with a circular buffer backsliding histogram to track recent distributions. The periodic parameters are stored in a circular buffer. When a latest periodic parameter is determined, the periodic parameter is input to the circular buffer to overwrite the oldest periodic parameter stored in the buffer. The backsliding histogram is updated by incrementing the count of the histogram bin the latest periodic parameter belongs to and decrementing the count of histogram bin the oldest periodic parameter belongs to. The mode tracker outputs the histogram bin with the largest count when the count is greater than a histogram threshold defined as Th_{hist}=C×total_count, where 0<C<1 (e.g., C=0.5) and total_count is the total count of periodic parameters recorded in the histogram. For each histogram bin, the count of periodic parameters in the histogram bin, denoted by Count(bin), is compared with the histogram threshold. When the following condition is satisfied
Count(bin)>Th_{hist} (23)
the latest periodic parameter with a count added to the bin with Count(bin) that satisfies Equation (23) is used to forecast periodic metric data. On the other hand, if none of the counts of the histogram bins are greater than the histogram threshold, then forecasting of the metric data is not carried out with any of the periodic parameters of the histogram bins and the metric data in the historical window does not have a periodic pattern.
FIGS. 30A30B show plots of example periodic parameters for the pulse wave model and the seasonal model, respectively. Horizontal axes, such as horizontal axis 3002, represent a time bin axis. Vertical axis, such as vertical axis 3004, represent counts. In FIG. 30A, histogram 3006 represents a backsliding histogram of pulse widths and histogram 3008 represents a backsliding histogram of periods for pulsewave metric data for seasonal model. Dashed line 3010 represents a histogram threshold for pulse widths. Dashed line 3012 represents a histogram of threshold for periods. In the example of FIG. 30A, the count of pulse widths in histogram bin 3014 is greater than the histogram threshold 3010 and the count of periods in histogram bin 3016 is greater than the histogram threshold 3012. In this case, the most recent pulse width and period counted in corresponding historical bins 3014 and 3016 are pulse wave period parameters used to forecast pulse wave metric data. In FIG. 30B, histogram 3018 represents a backsliding histogram of periods for seasonal model. Dashed line 3020 represents a histogram threshold for periods. In the example of FIG. 30B, the count of periods in histogram bin 3022 is greater than the histogram threshold 3020. In this case, the most recent period that corresponds to histogram bin 3022 is a seasonal periodic parameter used to forecast seasonal metric data.
Returning to FIG. 18, junction 1812 represents combining appropriate models for forecasting metric data over a forecast interval executed in block 1813. Let {tilde over (z)}_{n+1 }represent forecasted metric data values for lead times t_{n+1 }in a forecast interval with I=1, . . . , L. The following three conditions are considered in combing appropriate models in junction 1812 for computing a forecast over a forecast interval in block 1813:
(1) Metric data in the historical window may not have a pulse wave pattern or a seasonal period. In this case, metric data are forecasted in block 1813 by combining the trend estimate given in Equation (2a) and the stochastic process model with the smallest accumulated residual error as follows:
z_{n+1}=T_{n+1}+{circumflex over (z)}_{n+1}^{(m)} (24)
FIG. 31A shows a plot of example trendy, nonperiodic metric data and forecasted metric data over a forecast interval. Jagged curve 3102 represents a nonseasonal sequence of metric data with an increasing trend over historical window 3104. At time stamp t_{n}, a forecast is requested for a forecast interval 3106. The parameters of the trend estimate and the stochastic process models are computed from the sequence of metric data in the historical window 3106 as described above. Jagged dashedline curve 3108 represents forecasted metric data computed using Equation (24) at lead times in the forecast interval 3106.
(2) Metric data in the historical window may be pulse wave metric data. In this case, metric data are forecasted in block 1813 by combining the trend estimate given in Equation (2a) with the stochastic process model AR(0), ARMA(0,0), or ARIMA(0,0) and the latest pulse width and period given by backsliding histogram as described above with reference to FIG. 30A as follows:
$\begin{array}{cc}{\stackrel{~}{z}}_{n+l}={T}_{n+l}+{a}_{n+l}+S\ue8a0\left(A,\mathrm{pw},p\right)\ue89e\text{}\ue89e\mathrm{where}\ue89e\text{}\ue89eS\ue8a0\left(A,\mathrm{pw},p\right)=\{\begin{array}{cc}A& {t}_{s}+m\ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89ep\le {t}_{n+l}\le {t}_{s}+m\ue8a0\left(p+\mathrm{pw}\right)\\ 0& {t}_{n+l}<{t}_{s}+m\ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89ep\ue89e\phantom{\rule{0.8em}{0.8ex}}\ue89e\mathrm{and}\ue89e\phantom{\rule{0.8em}{0.8ex}}\ue89e{t}_{s}+m\ue8a0\left(p+\mathrm{pw}\right)<{t}_{n+l}\end{array}\ue89e\text{}\ue89em=1,2,\dots \ue89e\phantom{\rule{0.8em}{0.8ex}}\ue89e\mathrm{for}\ue89e\phantom{\rule{0.8em}{0.8ex}}\ue89e{t}_{s}+m\ue89e\phantom{\rule{0.3em}{0.3ex}}\ue89ep\le {t}_{n+L}.& \left(25\right)\end{array}$
FIG. 31B shows a plot of example trendy, pulsewave metric data and forecasted metric data over a forecast interval. Pulses 31103113 represent sequence of pulse wave metric data with a decreasing trend over historical window 3114. At time stamp t_{n}, a forecast is requested for a forecast interval 3116. Upward edges of forecasted pulses in the forecast interval 3114 are given by (t_{s}+mp,A+T_{n+1}+a_{n+1}) and downward edges of forecasted pulses in the forecast model are given by (t_{s}+m(p+pw), A+T_{n+1}+a_{n+1}). Dashedline pulses 3118 and 3120 represent two forecasted pulses of metric data computed using Equation (25) over the forecast interval 3116.
(3) Metric data in the historical window may not have a pulse wave pattern but may have a seasonal period. In this case, metric data are forecasted in block 1813 by combining the trend estimate given in Equation (2a) with the stochastic process model AR(O), ARMA(0,0), or ARIMA(0,0) and the seasonal period model with the latest principle period P given by the backsliding histogram as described above with reference to FIG. 30B as follows:
{tilde over (z)}_{n+1}=T_{n+1}+a_{n+1}+S_{(n+1)mod P} (26)
where
S_{(n+1)mod P}={circumflex over (z)}_{(n−P+1)mod P}; and
P is the principle period (i.e., P=N/k′).
FIG. 31C shows a plot of example trendy, seasonal metric data and forecasted metric data over a forecast interval. Sinusoidal curve 3122 represents metric data with an increasing trend over historical window 3124. At time stamp t_{n}, a forecast is requested for a forecast interval 3126. The parameters of the trend estimate and the seasonal periodic model are computed from the sequence of metric data in the historical window 3124 as described above. Dashed curve 3128 represents forecasted metric data computed using Equation (26) over the forecast interval 3126.
Returning to FIG. 15, analytics features, such as workload placement 1514, capacity planning 1516, and other applications 1518, proactively request forecasts over forecast intervals from a metric processor of the forecast engine 1504. The analytics features utilize the forecasted metric data to proactively optimize resource utilization and avoid potential problems. For example, when forecasted metric data approaches or is expected to exceed a resource threshold limit in the forecast interval, the analytics features may move or schedule virtual objects to proactively avoid slowdowns created by overused resources and thereby optimizing resource utilization.
FIGS. 32A32C show an example of planning optimal resource usage of a cluster of server computers. The resource may be CPU usage, memory usage, network throughput, or another resource of a server computer. FIG. 32A shows a plot of resource demand by a VM over a historical window and forecast interval. Historical and forecasted demand for the resource are represented by bars. Each bar represents demand for the resource in a time bin. For example, bar 3202 represents current demand for the resource by the VM. Forecasted demand in each time bin of the forecast interval 3204 is computed as described above. Dashed line 3206 represents effective demand for the resource by the VM. In other words, the largest forecast demand represented by bar 3208 corresponds to the intended demand for the resource in the future.
FIG. 32B shows a plot of collective demand for the resource by a clusters of server computers. Each bar represents cluster demand for the same resource by the cluster of server computers in a time bin. Each bar represents demand for the resource in a time bin. For example, bar 3210 represents current demand for the resource by the cluster of server computers. Forecasted demand in each time bin of the forecast interval 3212 is computed as described above. Dashed line 3214 represents effective demand for the resource by the cluster of server computers. In other words, the largest forecast demand represented by bar 3216 corresponds to the intended demand for the resource in the future.
FIG. 32C show the result of adding the historical and forecasted demand for the resource by the VM to the historical and forecasted demand for the resource by the cluster of server computers. If the VM was added to the cluster of server computers, the current demand for the resource would be represented by bar 3218. The forecasted combined effective demand would be increased as represented by dashed line 3220. The forecasted combined effected demand over the forecast interval can be used to redistribute resources in the cluster to accommodate the VM. Alternatively, the forecasted combined effected demand over the forecast interval may be compared with the capacity of the resource. If the forecasted combined effective demand is greater than the capacity of the resource for the cluster, the workload placement 1514 may deny migration or starting of the VM in the cluster of server computers. Alternatively, if the forecasted combined effective demand is less than the capacity of the resource for the cluster, the workload placement 1514 may generate a recommendation to migrate or start the VM in the cluster of server computers, or the workload placement 1514 may proactively migrate the VM in the cluster of the server computers.
Forecasted metric data provides three advantages over reactive analytics that identify problems in metric data: First, forecasting metric data allows workload placement 1514 to predict stress levels of a cluster, server computer, network, or any resource in the future and proactively rebalance workloads to avoid reaching a threshold for utilization of the resource. Second, forecasting metric data enables workload placement 1514 to make more precise changes in use of resources to reduce stress on resources and avoid moving applications, VMs, and containers from server computer to server computer, thereby efficiently utilizing server computer and cluster resources. Third, forecasting metric data allows workload placement 1514 to place applications, VMs, and containers in the same cluster of server computers provided the forecast peaks occur at different times and the superimposed effective demand for cluster resources do not cross corresponding resource thresholds.
The methods described below with reference to FIGS. 3340 are stored in one or more datastorage devices as machinereadable instructions that when executed by one or more processors of the computer system shown in FIG. 1 to manage resource utilization in a distributed computing system.
FIG. 33 shows a controlflow diagram of a method to manage a resource of a distributed computing system. In block 3301, a stream of metric data is received at a metric processor as described above with reference to FIG. 17. In block 3302, a routine “remove trend from the stream” is called. In block 3303, a routine “compute stochastic process models” is called. In block 3304, a routine “compute periodic models” is called. In decision block 3305, when a forecast requested is received, control flows to block 3306. Otherwise, control flows to block 3301. In block 3306, a routine “compute forecast” is called. In block 3307, utilization of resources may be adjusted to accommodate the forecast. For example, virtual objects may be migrated or started on a computer based on the forecast, as described above with reference to FIG. 39. In decision block 3308, when a user selects stop forecast, the analytics services manager stops sending the stream of metric data to the metric processor.
FIG. 34 shows a controlflow diagram of the routine “remove trend from the stream” called in block 3302 of FIG. 33. In block 3401, least squares parameters for the sequence of metric data in the historical window, as described above with reference to Equations (2c) and (2d). In block 3402, a goodnessoffit parameter is computed as described above with reference to Equation (3). In decision block 3403, when the goodnessofparameter is greater than a threshold, control flows to block 3404. In block 3404, a trend computed using the least squares parameters is subtracted from the metric data in the historical window, as described above with reference to Equations (2a), (4) and FIGS. 19B and 19C.
FIG. 35 shows a controlflow diagram of the routine “compute stochastic process models” called in block 3303 of FIG. 33. A loop beginning with block 3501 repeats the computational operations represented by blocks 35023507 for each J different stochastic models, where J is the number of different stochastic models. In block 3502, weight parameters of a stochastic process model are computed based on previous values of the nontrendy metric data in the historical window, as described above with reference to FIG. 20. In block 3503, when a new nontrendy (e.g., detrended) metric data values is received, estimated metric data values are computed using each of the stochastic process models as described above with reference to Equation (9) and FIG. 21. In block 3504, a residual error is computed for each of the stochastic process models as described above with reference to Equation (10). In block 3505, an accumulated residual error is computed for the stochastic model as described above with reference to Equation (10). In decision block 3506, when weight parameters and accumulated residual errors have been computed for each of stochastic process models, control flow to block 3508. Otherwise, the parameter j is incremented in block 3507. In block 3508, a minimum residual error is initialized (e.g., Error(s)=100). A loop beginning with block 3509 repeats the computational operations of blocks 35103512 for each stochastic process model to identify the stochastic process model with the smallest accumulated residual error. In decision block 3510, when the accumulated residual error of the jth stochastic process model is less the minimum residual error, control flow to block 3511. Otherwise, control flows to decision block 3512. In block 3511, the minimum residual error is set equal to the accumulated residual error. In decision block 3512, when accumulated residual errors for all J of the stochastic residual models have been considered control returns to FIG. 33. In block 3513, the parameter j is incremented.
FIG. 36 shows a controlflow diagram of the routine “compute periodic models” called in block 3304 of FIG. 33. In block 3601, logical parameters “Pulse wave” and “Seasonal” are set to FALSE. In block 3602, the EWMA is computed as described above with reference to Equation (14a). In decision block 3603, when the absolute difference Δ_{n+1 }satisfies the condition given by Equation (14b), control flows to block 3604. Otherwise, control flows to block 3608. In block 3604, a routine “apply edge detection” is called. If pulse edges are determined in block 3604, “Pulse wave” is set to TRUE. In decision block 3605, if “Pulse wave” is set to TRUE, control flows to block 3604. Otherwise, control flows to block 3608. In block 3606, pulse width and period of a pulse wave are computed as described above with reference to FIG. 26A26B. In block 3607, pulse wave backsliding histograms of pulse width and period are updated as described above with reference to FIG. 30A. In block 3608, a routine “compute seasonal parameters” is called. If a seasonal parameter is determined in block 3608, “Seasonal” is set to TRUE. In decision block 3607, if “Seasonal” is set to TRUE, control flows to block 3610. In block 3610, a seasonal backsliding histogram is updated, as described above with reference to FIG. 30B.
FIG. 37 shows a controlflow diagram of the routine “apply edge detection” called in block 3601 of FIG. 36. In block 3701, a smoothing filter is applied to the metric data in the historical window. In block 3702, gradients are computed as described above with reference to Equation (15). In block 3703, nonmaximum edge suppression is applied as described above with reference to FIGS. 25C and 25D. A loop beginning with block 3704 repeats the computation operations of blocks 37053708 for each gradient. In decision block 3705, when the gradient is greater than a threshold Th+, control flows to block 3706. In block 3706, the time stamp of the gradient and amplitude at the time stamp binary representation of positive gradient are recorded in a datastorage device as described above with reference to FIG. 26B. In decision block 3707, when the gradient is less than a threshold Th, control flows to block 3708. In block 3708, the time stamp of the gradient and amplitude at the time stamp binary representation of negative gradient are recorded in a datastorage device as described above with reference to FIG. 26B. In decision block 3709, operations represented by blocks 37053708 are repeated for another gradient. In decision block 3710, when pulse edges of a pulse wave have been detected by conditions 3705 and 3707, control flows to block 3711. In block 3711, “Pulse wave” is set to TRUE.
FIG. 38 shows a controlflow diagram of the routine “compute seasonal parameters” called in block 3604 of FIG. 36. A loop beginning with block 3801 repeats the computational operations represented by blocks 38023805 for short, medium, and long sampling rates, as described above with reference to FIG. 27. In other implementations, the number sampling rates may be larger than three. In block 3802, a routine “compute period of stream” is called. In decision block 3803, when a period of the stream is determined, the period is returned and control flows to block 3804. In block 3804, “Seasonal” is set to TRUE. In decision block 3805, the computational operations represented by blocks 38023804 are repeated for a longer sample rate.
FIG. 39 shows controlflow diagram of the routine “compute period of stream” called in block 3802 of FIG. 38. In block 3901, a periodogram is computed for a shorttime window of the historical window as described above with reference to Equations (16)(17) and FIG. 28. In block 3902, the area of the periodogram is computed as described above with reference to Equation (18). In decision block 3903, if no frequencies of the periodogram satisfy the condition of Equation (19), then no candidate principle frequencies exist in the periodogram and the routine does not return a seasonal period for the shorttime window. Otherwise, control flows to block. In block 3904, a circular autocorrelation function is computed in neighborhoods of candidate periods that correspond to the candidate principle frequencies, as described above with reference to Equation (20) and FIG. 29B. A loop beginning with block 3905 repeats the computational operations of blocks 39063909 for each candidate period. In block 3906, curvature near a candidate period is estimated as described above with reference to Equation (22). In decision block 3907, when the curvature corresponds to a local maximum, control flows to block 3908. In block 3908, the period is refined to the period that corresponds to the maximum ACF value in the neighborhood and the period is returned as the principle period, as described above with reference to FIG. 29C. In decision block 3909, operations represented by blocks 39063908 are repeated for another candidate period. Otherwise, no principle period is returned.
FIG. 40 shows a controlflow diagram the routine “compute forecast” called in block 3306 of FIG. 33. In decision block 4001, when “Pulse wave” equals TRUE, control flows to block 4002. In block 4002, a forecast is computed over a forecast interval as described above with reference to Equation (25). In decision block 4003, when “Seasonal” equals TRUE, control flows to block 4004. In block 4004, a forecast is computed over the forecast interval as described above with reference to Equation (26). In block 4005, a forecast is computed over the forecast interval as described above with reference to Equation (24).
Performance Results
The forecast engine, described above, was evaluated for 95 typical streams of metrics data. The 95 streams of metric data comprised CPU usage, memory usage, disk usage for VMs, hosts, and data center clusters collected over a onemonth period. To measure the performance for different model configurations, a set of synthetically generated sine and pulse waves of length about 100,000 data points (i.e., about one year of length with fiveminute sampling rate), and repeatedly expanded real metrics of the same length were also evaluated. The experiment was conducted on a 4core Macbook Pro. Table 1 reports the load, forecast time, and memory footprint:
TABLE 1

Memory
ModelLoad (ns)Forecast (ns)(bytes)


Trend model285.06651.951,360
ARMA model331.30380.97316
Periodic model413.13113.1318,142
Full model1,026.631,171.7319,818

Table I reveals that even with all models turned on, both the load and forecast operation (with a 2 hour forecast window) take about 1 μs to complete and the memory footprint is less than 20K. Hence, the forecast engine can be scale up to process 50K metric data streams per GB and handle about 1 million load/forecast requests per second on a single processor cote.
The accuracy of the forecast engine described above and were measured on the 95 metric data streams. The forecast engine was compared with mean and naïve value forecast models typically used to forecast time series data. The mean absolute percentage error (“MAPE”) was measure for each model with the results displayed in Table 2.
TABLE 2

Forecast
Score/ModelMean ModelNaïve ModelEngine

MAPE Score49.8933.3311.45

The forecast engine clearly reveals a lower MAPE than the other models typically used to forecast metric data.
It is appreciated that the previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.