The present invention provides a deployment platform that enables solution modules to be created and deployed without writing new code. The solution modules may include existing solutions, solution components, connectors, and the like selected from a solution library. The deployment platform includes a development engine providing functionality for generating deployment information for the solution module. The deployment information may include a blueprint or other information for deploying the solution module to target infrastructure. The deployment platform also includes a deployment engine providing functionality for deploying the solution module to the target infrastructure automatically. During deployment, the deployment engine pushes components of the solution module to the target infrastructure in accordance with the deployment information. During and after deployment, information may be captured and recorded to a distributed ledger to provide end-to-end visibility into the deployed solution over the deployment lifecycle (e.g., including initial deployment, updates/upgrades, and decommissioning).

A method for parsing log data according to an embodiment of the present disclosure includes loading a plurality of unit logs identified by first parsing log data into a memory in a two-dimensional matrix, wherein the unit log includes a plurality of items and constitutes one row, determining a target item to be second parsed among the items loaded into the memory, dividing data of the target item into a plurality of sub-items by second parsing the data of the target item, among the items loaded into the memory in the two-dimensional matrix and storing a second parsing result including the plurality of sub-items.

Systems, methods and computer program products for simulating workflows and activities of physical assets using digital twin models. User-defined simulations are performed by selectin digital twin components being analyzed during the simulation, concentrating the analysis on the selectively defined components and bypassing components that will not be simulated. Users can design the digital twin simulation using one or more available digital twin models. The model can be the most current digital twin model, a previous version of a model or a hybridized model comprising components or portions from multiple versions of the available digital twins. Users can further customize simulations by selecting components or sections of the digital twin model to selectively bypass during the simulation or provide overriding values for non-simulated portions of the digital twin which can be used as entry criteria inputted into the next simulated section or component of the digital twin, to complete the simulation.

Apparatuses and methods for anomaly detection. In one embodiment, a method is implemented in a computing device for building a tree structure to represent a system behavior includes obtaining one or more training log records; and building a tree structure using the one or more training log records. The tree structure includes a plurality of tree nodes. Each successive tree node in a root-to-leaf path of the tree structure representing successive log elements of the one or more training log records. Each of the one or more training log records includes one or more log elements. In one embodiment, a method implemented in a computing device for fault detection includes obtaining a live log record and determining an anomaly in the live log record by comparing corresponding successive elements of the live log record to successive nodes in a root-to-leaf direction of the tree structure.

Embodiments provide enhanced performance diagnosis in a network computing environment. In response to an occurrence of a performance issue for a node while under operating conditions, common logs for applications on the node are analyzed. The applications are respectively registered in advance for diagnosis services. The applications each register rules in advance for the diagnosis services. At a time of the performance issue, debug programs are automatically issued to generate debug level logs respectively for the applications. Debug level logs are analyzed according to the rules to determine a root cause of the performance issue. A potential solution to the root cause of the performance issue is determined using the rules, without having to recreate the operating conditions occurring during the performance issue. The potential solution to rectify the root cause of the performance issue is executed without having to recreate the operating conditions occurring during the performance issue.

In an approach for generating differentiated workload telemetry data, a processor corresponds one or more services with a workload related telemetry generating an event emitter. A processor performs a correlation analysis of corresponding relationship and connection among connected resources and current traffic into and out of the one or more services. A processor labels domain context for each telemetry event. A processor communicates each telemetry event to a global event handler. A processor performs a cross-correlation in real-time of telemetry data with the global event handler. A processor updates a real-time differentiated workload report.

Systems are provided for logging transactions in heterogeneous networks that include a combination of one or more instrumented components and one or more non-instrumented components. The instrumented components are configured to generate impersonated log records for the non-instrumented components involved in the transaction processing hand-offs with the instrumented components. The impersonated log records are persisted with other log records that are generated by the instrumented components in a transaction log that is maintained by a central logging system to reflect a complete flow of the transaction processing performed on the object, including the flow through the non-instrumented component(s).

Techniques for determining insight are described. An exemplary method includes receiving a request to provide insight into potential abnormal behavior; receiving one or more of anomaly information and event information associated with the potential abnormal behavior; evaluating the received one or more of the anomaly information and event information associated with the abnormal behavior to determine there is insight as to what is causing the potential abnormal behavior and to add to an insight at least two of an indication of a metric involved in the abnormal behavior, a severity for the insight indication, an indication of a relevant event involved in the abnormal behavior, and a recommendation on how to cure the potential abnormal behavior; and providing an insight indication for the generated insight.

Event records from multiple computing devices are received at a managing unit. Individual event records include an event identifier field including an event identifier identifying a first event associated with a particular computing device, a parent event identifier field identifying a parent event that initialized the first event, and an entity identifier field including an entity identifier identifying the particular computing device. The managing unit generates log records associated with event identifiers included in the event records. The log records include state fields indicating a state of a particular event associated with a particular event identifier. Based on a correlation of the event and log records, the managing unit determines at least two computing devices associated with events resulting in an error state, and identifies parent events that initialized the events with errors. The managing unit generates a report linking the parent events to the events having an error state.

Example implementations relate to consensus protocols in a stretched network. According to an example, a distributed system includes continuously monitoring network performance and/or network latency among a cluster of a plurality of nodes in a distributed computer system. Leadership priority for each node is set based at least in part on the monitored network performance or network latency. Each node has a vote weight based at least in part on the leadership priority of the node. Each node's vote is biased by the node's vote weight. The node having a number of biased votes higher than a maximum possible number of votes biased by respective vote weights received by any other node in the cluster is selected as a leader node.