Free memory trending for detecting out-of-memory events in virtual machines
First Claim
1. A method, comprising:
- obtaining time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system;
computing, by a processor, a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series VM data, wherein the time window is computed by multiplying the working time scale by an average time between bursts from a series of high-activity events in the time-series VM data;
using a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine; and
storing an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine.
1 Assignment
0 Petitions
Accused Products
Abstract
The disclosed embodiments provide a system that detects anomalous events in a virtual machine. During operation, the system obtains time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system. Next, the system computes, by a service processor, a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series GC data. The system then uses a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine. Finally, the system stores an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine.
-
Citations
20 Claims
-
1. A method, comprising:
-
obtaining time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system; computing, by a processor, a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series VM data, wherein the time window is computed by multiplying the working time scale by an average time between bursts from a series of high-activity events in the time-series VM data; using a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine; and storing an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. An apparatus, comprising:
-
one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the apparatus to; obtain time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system; compute a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series VM data, wherein the time window is computed by multiplying the working time scale by an average time between bursts from a series of high-activity events in the time-series VM data; use a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine; and store an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine. - View Dependent Claims (12, 13, 14, 15, 16, 17)
-
-
18. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
-
obtaining time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system; computing a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series VM data, wherein the time window is computed by multiplying the working time scale by an average time between bursts from a series of high-activity events in the time-series VM data; using a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine; and storing an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine. - View Dependent Claims (19, 20)
-
Specification