Virtual machine snapshotting and analysis

• US 9,286,182 B2
• Filed: 06/17/2011
• Issued: 03/15/2016
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Fries, Robert, Hunt, Galen, Balakrishnan, Shobana
• Primary Examiner(s): Wong, Leslie
• Application Number:
  US13/163,582
• Publication Number:
  US 20120323853A1
• Time in Patent Office: 1,733 Days
• Field of Search: 706/15, 706/16, 706/20, 706/21, 706/46
• US Class Current: 1/1
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

Described are techniques for capturing and analyzing snapshots of virtual machines. One or more computers may automatically obtain snapshots of virtual machines as they are executing to form a pool of virtual machine snapshots. The virtual machine snapshots are then read to obtain a set of features properties of the virtual machine snapshots, including information about a running guest operating system, software installed on the virtual machine, metadata about the virtual machine itself, and others. The features or properties are analyzed, in one embodiment using a machine learning algorithm, to automatically compute and store information about the virtual machines.

Claims

1. A method, comprising:

accessing stored virtual machine snapshots, the virtual machine snapshots having been captured from one or more executing virtual machines; and

automatically forming a pool of features comprised of features obtained from the accessed virtual machine snapshots; and

performing automated analysis on the pool of features to identify one or more traits of one or more of the virtual machine snapshots, wherein the automated analysis either;

computes probabilities that correspond to the one or more virtual machines, respectively;

categorizes one or more of the virtual machines into one or more pre-defined categories;

or

ranks the one or more virtual machines relative to each other with respect to relevance to a predefined trait, wherein a rank of a virtual machine indicates its relative relevance to the predefined trait.

2. A method according to claim 1, wherein the automated analysis comprises a machine learning algorithm.

3. A method according to claim 2, wherein the automated analysis is performed using machine learning trained using a training dataset of features of training snapshots.

4. A method according to claim 1, wherein the virtual machine snapshots comprise snapshots taken at different times of a same virtual machine running at the different times.

5. A method according to claim 1, wherein the virtual machine snapshots having been captured from a hierarchy of virtual machines including parent virtual machines and child virtual machines, each child virtual machine having been produced by duplicating a corresponding parent virtual machine and then running with different state than the parent virtual machine.

6. One or more computer-readable storage media storing information to cause one or more computers to perform a process, the process comprising:

performing feature extraction on a plurality of concurrently stored virtual machine snapshots to obtain a set of feature values of features of the virtual machine snapshots, the virtual machine snapshots having been previously captured during execution of one or more virtual machines by capturing virtualized memory and virtualized disk data of the one or more virtual machines while the one or more virtual machines were online; and

performing automated reasoning on the extracted feature values to rank, identify, classify, and/or compute probabilities of traits of the virtual machines that corresponds to the feature values of trait the virtual machine snapshots, wherein the automated analysis comprises either;

computing probabilities that correspond to the virtual machines, respectively;

categorizing one or more of the virtual machines into one or more pre-defined categories;

or

ranking the virtual machines relative to each other with respect to relevance to a predefined trait, wherein a rank of a virtual machine indicates its relative relevance to the predefined trait.

7. One or more computer-readable storage media according to claim 6, wherein, the feature extraction comprises forming feature vectors of the virtual machine snapshots, where each feature vector comprises feature values of a corresponding virtual machine snapshot, the feature values of each feature vector corresponding to a same set of feature variables that define a feature space.

8. One or more computer-readable storage media according to claim 7, the processing further comprising processing the feature vectors with a machine learning algorithm.

9. One or more computer-readable storage media according to claim 6, further comprising performing a dimension reduction algorithm that reduces a number of feature values of each feature vector passed to the machine learning algorithm.

10. One or more computer-readable storage media according to claim 6, wherein each virtual machine snapshot comprises a file system containing a guest operating system and a copy of memory as managed by a running kernel of a guest operating system.

11. One or more computer-readable storage media according to claim 10, the feature extraction comprising at least one or more of:

identifying files in the file systems, obtaining feature values by reading the copies of memory, obtaining values of hardware resources of the virtual machines, obtaining configuration settings of the guest operating systems, and obtaining information about software installed on the virtual machines.

12. One or more computer-readable storage media according to claim 6, further comprising forming a training data set by labeling one or more of the feature vectors.

13. One or more computer-readable storage media according to claim 6, further comprising using the training data set to train a model or algorithm used to perform the automated reasoning.

14. One or more computer-readable storage media according to claim 6, further comprising storing, by the one or more computers, output about the virtual machines obtained by the reasoning.

15. A method for analyzing virtual machines, the method performed by one or more computers and comprising:

automatically periodically snapshotting each of the virtual machines as they are executing to form a pool of virtual machine snapshots, wherein the virtual machines remain online while being snapshotted, and wherein the pool of virtual machine snapshots comprises pluralities of periodically automatically captured snapshots of the respective virtual machines;

retaining the pool of virtual machine snapshots together in a snapshot repository;

reading the virtual machine snapshots in the snapshot repository to obtain therefrom a set of properties of the virtual machine snapshots;

storing the set of properties in a datastore; and

automatically computing and storing information about the virtual machines based on the set of properties in the datastore, the information about the virtual machines obtained by statistical computation, based on the properties, by the one or more computers, the statistical computation comprising at least;

computing probabilities that correspond to the virtual machines, respectively;

categorizing the virtual machines into one or more pre-defined categories;

or

ranking the virtual machines relative to each other with respect to relevance to a predefined trait, wherein a rank of a virtual machine corresponds to its relative relevance to the predefined trait.

16. A method according to claim 15, wherein the information about the virtual machines comprises information identifying a subset of the virtual machines.

17. A method according to claim 15, further comprising identifying one or more groups of similar or dissimilar virtual machines according to the properties, or ranking the virtual machines according to the properties.

18. A method according to claim 15, wherein the properties comprises values of property variables, the method further comprising identifying one or more property variables as predictive of a pre-defined condition or trait of the virtual machines.

19. A method according to claim 15, further comprising obtaining the set of properties from pieces of metadata associated with the virtual machines, respectively, the metadata comprising information about geographic locations, or hardware resources, or configurations of the virtual machines.