Multi-layered forecasting of computational workloads

Abstract

Techniques for multi-layered prediction of computing workloads are disclosed. A system identifies a level of granularity associated with a request for predicting the computing workload of a particular entity. The system obtains attribute data for computing resources at the identified level of granularity. The system determines whether computing resources not specified in the request should be included in the workload prediction. The system applies a time series prediction model to time series data obtained from the computing resources associated with the request. The system presents one or more workload predictions for the computing workload associated with the request.

Description

[Technical Field]

[0001] Incorporation by Reference (Disclaimer) Each of U.S. patent application Ser. No. 18 / 152,481, filed January 10, 2023, U.S. patent application Ser. No. 16 / 917,821, filed June 30, 2020, U.S. patent application Ser. No. 62 / 901,088, filed September 16, 2019, and U.S. patent application Ser. No. 62 / 939,603, filed November 23, 2019, is incorporated herein by reference. Applicant hereby withdraws any disclaimer of claims in the parent application or its prosecution history, and reports to the U.S. Patent and Trademark Office that the claims in this application may be broader than any claims in the parent application.

[0002] The subject matter of this application is related to the subject matter of U.S. Patent Application No. 10,331,802, entitled "System for Detecting and Characterizing Seasons," filed February 29, 2016, and issued U.S. Patent Application No. 15 / 057,065, which is hereby incorporated by reference.

[0003] The subject matter of this application is related to the subject matter of U.S. Patent Application No. 10,699,211, entitled "Supervised Method for Classifying Seasonal Patterns in Time Series Data," filed February 29, 2016, and issued U.S. Patent Application No. 15 / 057,060, which is hereby incorporated by reference.

[0004] The subject matter of this application is related to the subject matter of U.S. Patent Application No. 10,885,461, entitled "Unsupervised Method for Classifying Seasonal Patterns in Time Series Data," filed February 29, 2016, and issued U.S. Patent Application No. 15 / 057,062, which is hereby incorporated by reference.

[0005] Technical Field The present disclosure relates to analyzing time series data, and more particularly, to techniques for performing time series analysis to predict computing workloads. [Background technology]

[0006] background Applications and data are increasingly moving from on-premise systems to cloud-based software-as-a-service (SaaS) systems, where computing resources such as processors, memory, storage, network, and / or disk input / output (I / O) can be consumed by entities and / or components such as physical machines, virtual machines, applications, application servers, databases, database servers, services, and / or transactions.

[0007] Cloud service providers typically ensure that cloud-based systems have sufficient resources to meet customer demands and requirements. For example, cloud service providers may perform capacity planning, which includes estimating the resources required to operate a customer's applications, databases, services, and / or servers. Cloud service providers may also monitor the execution of a customer's systems and for performance degradation, errors, and / or other issues. However, such monitoring techniques are reactive, meaning that corrective actions to correct or mitigate issues are taken only after a system error, failure, and / or outage has occurred. Summary of the Invention

[0008] The approaches described in this section, while they could be pursued, are not necessarily approaches that have been previously conceived or pursued, and thus, unless otherwise indicated, it should not be assumed that any approach described in this section qualifies as prior art merely by virtue of its inclusion in this section.

[0009] The embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, and it should be noted that references to "an" or "one" embodiment in this disclosure do not necessarily refer to the same embodiment, but rather to at least one. [Brief explanation of the drawings]

[0010] [Figure 1A] FIG. 1 illustrates a system according to one or more embodiments. [Figure 1B] FIG. 1 illustrates a system according to one or more embodiments. [Figure 1C] FIG. 1 illustrates a system according to one or more embodiments. [Figure 2] FIG. 1 illustrates an example set of operations for multi-layer prediction of a workload, according to one or more embodiments. [Figure 3]FIG. 1 illustrates an exemplary set of operations for predicting workload in a multi-node cluster environment, according to one or more embodiments. [Figure 4] FIG. 1 illustrates an exemplary set of operations for determining data staleness while performing time series analysis, according to one or more embodiments. [Figure 5] FIG. 1 illustrates an exemplary set of operations for training a time series model, according to one or more embodiments. [Figure 6] FIG. 1 illustrates an example set of operations for anomaly detection using predicted computing workload, according to one or more embodiments. [Figure 7A] FIG. 1 illustrates an example embodiment of multi-layer prediction in a node cluster environment. [Figure 7B] FIG. 1 illustrates an example embodiment of multi-layer prediction in a node cluster environment. [Figure 7C] FIG. 1 illustrates an example embodiment of multi-layer prediction in a node cluster environment. [Figure 7D] FIG. 1 illustrates an example embodiment of multi-layer prediction in a node cluster environment. [Figure 8] FIG. 1 is a block diagram illustrating a computer system according to one or more embodiments. DETAILED DESCRIPTION OF THE INVENTION

[0011] Detailed Description In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in different embodiments. In some instances, well-known structures and devices are described with reference to block diagrams in order to avoid unnecessarily obscuring the present invention.

[0012] 1. Summary 2. System Architecture 3. Multi-layered forecasting of computational workloads 4. Anomaly Detection Using Predictive Compute Workload 5. Exemplary Embodiments 6. Computer Networks and Cloud Networks 7. Miscellaneous - Extensions 8. Hardware Overview 1. Summary A computing system includes various computing resources. The various computing resources may be capable of operating somewhat independently of one another. For example, two nodes of the same node cluster may run two independent virtual machines. While computing resources may operate independently of one another, system events may result in the operation of one computing resource affecting the operation of another computing resource. For example, frequent requests to access a shared database by one node of a node cluster may result in delays in the operations of another node also attempting to access the shared database. Therefore, generating workload forecasts for a computing environment to manage computing resources in the environment requires analyzing the computing resources at a sufficient level of granularity to capture the impact that the computing resources have on each other.

[0013] In one or more embodiments, a time-series forecasting model is applied to workload data to generate a workload forecast for a particular computing entity in a system topology. Workload forecasting captures workload data at a particular level of granularity to capture relationships between computing resources in the system. Various entities in the topology that make up the system are associated with various computing resource attributes and criteria. For example, a first entity, such as a physical bare-metal server, may utilize resources A, B, and C. A second entity, such as a database, may utilize resources A, D, and E. The first entity (e.g., the physical bare-metal server) may be associated with a relatively high resource utilization rate. The second entity (e.g., the database) may be associated with a relatively low resource utilization rate. In response to a request to initiate a workload forecast, the system (a) identifies a granularity level associated with the request and (b) identifies attributes associated with the corresponding entity and the identified granularity level. A lower granularity level may correspond to a virtual machine utilized by the entity to run an application. A relatively high level of granularity may correspond to specific criteria such as the number of processor cores of one or more nodes that (a) host virtual machines and (b) affect the operation of the nodes that host the virtual machines. The system matches entity attributes with a time series model trained on the entity's historical time series data. The system generates a workload forecast by applying the trained time series model to current time series data.

[0014] In one or more embodiments, based on receiving a request to generate a workload forecast for one computing resource associated with a certain level of granularity, the system generates a workload forecast for another computing resource associated with a different level of granularity. For example, the system may receive a request to generate a workload forecast for a virtual machine. The system identifies computing resources associated with the virtual machine (including a host node hosting the virtual machine, sibling nodes in the same node cluster as the host node, and a shared database accessed by the node cluster). The system identifies the node level as the level of granularity for generating the workload forecast. Further, the system determines that the sibling node affects the workload of the host node at a level that exceeds a threshold. Thus, in response to the request, the system presents workload forecasts for both the host node and the sibling node. The system generates the workload forecast by applying a time series forecasting model to attribute data from the host node and the sibling node.

[0015] According to one or more embodiments, the system includes a clustered configuration, such as a physical or virtual machine server, a database server, or an application cluster at a software-as-a-service (SaaS) layer. Furthermore, upon receiving a request to predict the workload of a host node in the cluster, the system identifies sibling nodes that affect the workload of the host node at a level above a threshold. Accordingly, the system, in response to the request, presents workload predictions for both the host node and the sibling nodes. The system generates the workload predictions by applying a time-series prediction model to attribute data from the host node and the sibling nodes. This logic also applies to any workload cluster that consumes resources, such as a node cluster serving a database or a node cluster serving an application, both on-premise or cloud-based (e.g., SaaS, DBaaS, PaaS, or IaaS).

[0016] 2. System Architecture 1 illustrates a system 100, according to one or more embodiments. As shown in FIG. 1, the system 100 includes a computing system 110, an application server 120, a resource management system 130, and a user interface 140.

[0017] Computing system 110 is a system managed by resource management system 130. Computing system 110 includes one or more data repositories 111 and one or more nodes 112, 113, 114, and 115 configured to interact with data repository 111, each other, other nodes, and application server 120 to execute workloads. According to one embodiment, nodes 112-115 are nodes in a node cluster. The node cluster including nodes 112-115 operates as a group to execute designated tasks. Nodes may be servers, for example, equipped with processors and memory for executing tasks independently of each other. For example, one of nodes 112-115 may be designated as a master node that receives computing tasks for a workflow and distributes the tasks among the nodes in the cluster. Nodes 112-115 may also execute tasks associated with various workflows. For example, each node 112-115 may be assigned to a different client. Node 112 may handle requests to access data repository 111 from one client. Node 113 may be designated to handle requests to access data repository 111 from another client simultaneously with the operation of node 112. Clients accessing a cluster of nodes may interact with a server, such as a master node or load balancer. The master node or load balancer may distribute data corresponding to an assigned workflow to the nodes corresponding to the assigned workflow. Parallel operation of various nodes in a cluster of nodes may allow a workload containing many separate, parallelizable tasks to be distributed among the nodes 112-115 in the cluster. Each of nodes 112-115 may have its own processor and local memory. The cluster may be configured to provide failover capabilities, allowing one node to take over the workload of another node in the event of a failure.The cluster may be configured such that a load balancing server manages the workload of each of the nodes 112-115 to provide load balancing to a specified degree among the respective nodes 112-115. The computing system 110 may comprise components of one or more data centers, co-location centers, cloud computing systems, on-premise systems, clusters, content delivery networks, server racks, and / or other collections of processing, storage, network, input / output (I / O), and / or other resources.

[0018] As shown in FIG. 1A , computing system 110 runs virtual machines 121 and 122. Each virtual machine 121 and 122 is associated with a respective workload 123 and 124. A workload represents a set of tasks required to perform the functionality of virtual machine 121 or 122. Client 126 accesses virtual machine 122 over a network. When client 126 runs application 125 on virtual machine 122, application 125 and any operating system and other applications running on virtual machine 122 generate tasks that make up workload 124. Node 115 hosts virtual machine 122. Node 115 is associated with workload 119. Workload 119 includes workload 124 associated with virtual machine 122, for example, as well as any other virtual machines, background applications, and management programs running on node 115. Each node 112-115 is associated with a respective workload 116-119. In one or more embodiments, the operation of one node affects the operation of one or more additional nodes. For example, one node may be configured to take over some or all of another node's workload in the event of a node failure. Also, one node may have a different set of hardware (e.g., more processing threads) that allows it to complete tasks faster than another node. A master node or load balancer may redirect tasks from less efficient nodes to more efficient nodes to more efficiently complete tasks assigned to the node cluster. Thus, if one node's performance frequently degrades, the computational burden on nodes with better overall performance may increase, causing task congestion and reducing the efficiency of the more efficient nodes.

[0019] 1A , virtual machine 122 executes application 125. In operation, client device 126, such as a personal computer or other computing device, communicates with computing system 110, which may include a lead server, master server, or load balancer for a node cluster, to execute virtual machine 122. Node 115 designates processing capacity and memory for executing virtual machine 122. Node 115 executes application 125 on the virtual machine. Client device 126 includes a user interface that presents the appearance to a user that application 125 is executing on the client device while application 125 is executing on node 115. In this manner, the processing capacity of node 115 is primarily used to execute application 125, while the processing capacity of client device 126 is used to communicate with node 115 and display interfaces associated with the running application.

[0020] As shown in FIG. 1B , resource management system 130 includes monitoring module 131 that is capable of monitoring and / or managing resource utilization or consumption on computing system 110. For example, monitoring module 131 may collect and / or monitor metrics related to utilization and / or workload on processor, memory, storage, network, I / O, thread pool, and / or other types of hardware and / or software resources. Additionally or alternatively, monitoring module 131 may collect and / or monitor performance metrics such as latency, queries per second (QPS), error count, garbage collection count, and / or garbage collection time on the resources. Monitoring module 131 may be implemented by any set of sensors and / or software-based monitoring applications. According to an exemplary embodiment, monitoring module 131 is implemented as an agent or program that runs in the background of other programs running on computing system 110.

[0021] Resource management system 130 may also perform such monitoring and / or management at various levels of granularity and / or for various entities. For example, resource management system 130 may evaluate resource utilization and / or workload at the level of an environment, cluster, host, virtual machine, database, database server, application, application server, transaction (e.g., a series of clicks on a website or web application to complete an online order), and / or data (e.g., database record, metadata, request / response attributes, etc.). Resource management system 130 may also define entities using a set of entity attributes and perform monitoring and / or analysis based on criteria associated with the entity attributes. For example, resource management system 130 may identify entities as a combination of customer, type of criteria (e.g., processor utilization, memory utilization, etc.), and / or level of granularity (e.g., virtual machine, application, database, application server, database server, transaction, etc.). In the example shown in FIG. 1A, the system may define an entity as an organization associated with client device 126. Attributes associated with an entity may include virtual machines executed by client devices of the organization, nodes hosting the virtual machines, applications running on the virtual machines, and hardware (e.g., processors, processing threads, memory) that make up the nodes hosting the virtual machines. Additional attributes may include applications, node clusters, nodes, databases, processors, memory, and workflows associated with the organization.

[0022] The monitoring module 131 stores metrics associated with workloads of the computing system 110 in a data repository 170. The stored metrics constitute historical data 171. The historical data 171 includes time series data and may include one or more of the following characteristics: seasonality 172, multi-seasonality 173, trend 174, and shocks or outliers 175.

[0023] The resource management system 130 includes a training module 150 that uses machine learning techniques to generate time series models for various entities associated with the monitored system. The training module 150 retrieves historical time series data 171 (e.g., a combination of customers, criteria, and granularity levels) for a given entity from a data repository 170. The training module 150 divides the historical time series data into a training dataset 151, a test dataset 152, and a validation dataset 153. The training module 150 uses the training dataset 151 to train a set of time series models and tests the set of time series models using the test dataset 152. The training module 150 validates the models using the validation set 153. Based on the training, testing, and validation, the training module 150 generates one or more time series model options to use in evaluating subsequent time series criteria. The time series model options may be retrieved from the data repository 170.

[0024] Resource management system 130 includes a workload prediction module 160 that uses the time series model generated by training module 150 to generate predictions of metrics representing resource consumption and / or workload on monitored computing system 110. In these embodiments, the time series model analyzes time series data including metrics collected from the monitored system and predicts future values ​​in the time series data based on past observations in the time series data.

[0025] In one or more embodiments, the prepared time series models are stored in a data repository 170 and later used for forecasting. The time series models 176 include one or more of a Holt-Winters Exponential Smoothing (HES) model and a Trigonometric Seasonality Box-Cox ARMA Trend and Seasonal (TBATS) model 177, an Auto-Regressive Integrated Moving Average (ARIMA) model 178, a Seasonal ARIMA model (SARIMAX) 179 with exogenous variables as parameters 154 (p, d, q, P, D, Q, frequency), or any combination of these or alternative models.

[0026] The time series model 176 includes components representing seasonality, multi-seasonality, trends, and shocks or outliers in the historical time series data 171. The components of the time series model 176 also include Fourier terms that are added as external regressors to the ARIMA model 178 or the SARIMAX model 179 when multi-seasonality 173 is present in the historical data 171. These components of the time series model 176 improve the accuracy of the model and enable the model 176 to adapt to various types of time series data collected from the monitored system. In one embodiment, the time series model 176 includes exogenous variables that represent outliers 175 in the historical time series data 171 to reduce or eliminate the impact of outliers 175 in the model generated with the historical time series data 171 on the predictions of the workload forecasting module 160.

[0027] In one or more embodiments, the time series model 176 includes one or more variants of an Auto-Regressive Integrated Moving Average (ARIMA) model 178 and / or an Exponential Smoothing model 177 .

[0028] In some embodiments, the ARIMA model 178 is a generalization of the Auto-Regressive Moving Average (ARMA) model with the following expression:

[0029]

number

[0030] The above expression can be simplified as follows: φ p (B)Y t =θ q (B)a t In the above expression, Y t represents the value Y in the time series indexed by time step t, and φ1, . . . , φ p are the autoregressive parameters to be estimated, and θ1, , θ q are the moving average parameters to be estimated, and a1, , a t represents a set of unknown random errors (or residuals) that are assumed to be normally distributed.

[0031] In one embodiment, training module 150 utilizes the Box-Jenkins method to detect the presence or absence of stationarity and / or seasonality in historical time series data 171. For example, the Box-Jenkins method may utilize an autocorrelation function (ACF), a partial ACF, a correlogram, a spectral plot, and / or other techniques to assess stationarity and / or seasonality in a time series.

[0032] If training module 150 determines that only non-stationarity is found, it may add some difference d to the ARMA model to produce an ARIMA model of the form:

[0033] φ p (B)(1-B) d Y t =θ q (B)at If the training module 150 determines that seasonality is found, it may add a seasonal component to the ARIMA model to generate a seasonal ARIMA (SARIMA) model of the form:

[0034] φ p (B)Φ(P)(B s )(1-B) d (1-B s ) D Y t =θ q (B)Θ q (B s )a t In the SARIMA model, the parameters p, d, and q represent the trend components of the autoregressive order, the difference order, and the moving average order, respectively; the parameters P, D, and Q represent the seasonal components of the autoregressive order, the difference order, and the moving average order, respectively; and the parameter s represents the time series K. i Represents the number of seasons (e.g., hours, days, weeks, months, years, etc.) in a given time period.

[0035] In one or more embodiments, the training module 150 applies Fourier terms to the time series model 176. For example, if multiple seasons are detected in the time series, a Fourier term may be used to represent the seasonal pattern, which is added as an external regressor in the ARIMA model.

[0036]

number

[0037] In the above equation, N t is an ARIMA process, and P1, , P M represents the period in the time series (e.g., hours, days, weeks, months, years, etc.), and the Fourier terms are included as a weighted sum of sine-cosine pairs.

[0038] The time series model 176 may include exogenous variables that represent outliers 175 in the historical data 171 and that represent external influences and / or shocks. In one embodiment, the training module 150 adds the exogenous variables to the above ARMAX model to generate an Auto-Regressive Moving Average (SARMAX) model with exogenous inputs of the following form:

[0039]

number

[0040] In the above expression, β1, , β r are parameters of the time-varying exogenous input X. In additional embodiments, training module 150 includes exogenous variables in the ARIMA and / or SARIMAX models. In computing system 110, exogenous variables may represent system backups, batch jobs, periodic failovers, and / or other external factors that affect workload, resource utilization, and / or other metrics in the time series. These external factors may cause spikes in workload metrics that do not follow the underlying seasonal pattern of historical time series data 171.

[0041] In one or more embodiments, the Exponential Smoothing model includes a Trigonometric Seasonality Box-Cox ARMA Trend Seasonal (TBATS) component model. The TBATS model includes the following expressions:

[0042]

number

[0043]

number

[0044] The seasonal component of the TBATS model is expressed as:

[0045]

number

[0046] In the above equation, k i is the number of harmonics required for the ith seasonal period, λ is the Box-Cox transformation, and γ1 (i) and γ2 (i) represents the smoothing parameter.

[0047]

number

[0048] ·Whether or not to use Box-Cox transformation ·Whether there is a trend ·Whether or not the trend is decaying Presence or absence of an ARMA(p,q) process to model the residuals Seasonality Variation in the number of harmonics used to model seasonal effects 1C , in one or more embodiments, the resource management system 130 includes a training module 150 that uses supervised learning techniques to generate time series models 176 for various entities associated with the monitored system. Initially, the training module 150 retrieves historical time series data (e.g., combinations of customers, criteria, and granularity levels) for a given entity from the data repository 170. For example, the training module 150 may match the entity's entity attributes 157 with records in a database that store the entity's historical time series data (e.g., criteria collected from the entity over the past week, month, year, and / or other time periods). Each record may include a value for the criterion, a timestamp representing the time the value was generated, and / or an index representing the value's position in the time series.

[0049] Next, the training module 150 divides the historical time series data into a training dataset 151 and a test dataset 152. For example, the training module 150 may prepare the training dataset 151 with a majority (e.g., 60-80%) of the time series data and prepare the test dataset 152 with the remaining time series data. In some embodiments, the training module 150 selects the size of the test dataset 152 to represent the prediction range of each time series model, as determined by the granularity of the time series data. For example, the training module 150 may include in the test dataset 152 24 observations per day of hourly collected data (corresponding to one or several thousand observations for a one-week dataset consisting of multiple hourly observations), 7 observations per week of daily collected data, and / or 4 observations per month of weekly collected data. The training module 150 optionally generates multiple training and test datasets from the same time series data using cross-validation techniques.

[0050] The training module 150 uses the training dataset 151 to train a set of time series models 176 with various parameters 154. For example, the training module 150 uses the Box-Jenkins method and / or another method to generate a search space of parameters 154 for various ARIMA-type models (including SARIMA, ARIMAX, and / or SARIMAX) and / or TBATS-type models. The training module 150 then fits each model to the training dataset 151 using maximum likelihood estimation (MLE) techniques, ordinary least squares (OLS) techniques, and / or another technique.

[0051] After the set of time series models 176 is generated from the training dataset 151, the training module 150 evaluates the performance of each model using the test dataset 152. In particular, the training module 150 uses the time series models 176 to generate predictions 155 of values ​​in the test dataset 152 based on past observations in the time series data. The training module 150 also determines accuracy values ​​156 for the time series models 176 based on a comparison of the predictions 155 and corresponding values ​​in the test dataset 152. For example, the training module 150 calculates the mean squared error (MSE), root mean square error (RMSE), AIC, and / or another measure of model quality or accuracy between the predictions 155 and the corresponding values ​​in the test dataset 152 for all time series models 176 generated from the entity's historical time series data.

[0052] Finally, the training module 150 generates a selection 158 of one or more time series models 176 to use in evaluating subsequent time series criteria for the same entity or entities of similar attributes 157 within a similarity threshold level. For example, the training module 150 includes in the selection 158 the one or more time series models 176 that have the highest accuracy values ​​156 in predicting values ​​in the test dataset 152.

[0053] After one or more best time series models 176 are selected for one or more entities, training module 150 stores the parameters of each model in a model repository, such as data repository 170. Additionally or alternatively, training module 150 provides representations of the models to monitoring module 131, user interface 140, and / or other components of resource management system 130.

[0054] The workload prediction module 160 retrieves the most recent collection baseline of each entity's time series from the data repository 170 and inputs the data into the corresponding time series model 176 generated by the training module 150. The time series model 176 then outputs predictions 161 of future values ​​in the time series as the predicted workload, resource utilization, and / or performance associated with the entity.

[0055] The monitoring module 131 includes functionality for predicting anomalies based on a comparison of the predictions generated by the workload prediction module 160 with corresponding thresholds. For example, the thresholds may represent limits on resource utilization by an entity and / or service level objectives for performance metrics associated with the entity. If a predicted metric violates (e.g., exceeds) a corresponding threshold, the monitoring module 131 may detect potential future anomalies, errors, outages, and / or failures in the operation of hardware and / or software resources associated with the entity. For example, an entity in the topology comprising the system may suffer a fault that is reflected in time-series data as a spike or growth / trend. A model-based prediction can recognize this sudden change in resource utilization, which is reflected to the user identifying a “change” in usage that requires investigation.

[0056] If an anomaly is predicted in a metric for a given entity, the monitoring module 131 communicates the predicted anomaly to one or more users involved in managing the entity's use of the monitored system. For example, the monitoring module 131 may include a graphical user interface (GUI), a web-based user interface, a mobile user interface, a voice user interface, and / or another type of user interface that displays a plot of the metric as a function of time. The plot may additionally include a representation of one or more thresholds for the metric and / or predicted values ​​of the metric from a time series model of the corresponding entity. If the predicted values ​​violate a given threshold, the user interface may display highlighting, coloring, shading, and / or another indicator of the violation as a prediction of a future anomaly or problem in the entity's use of the monitored system. In another example, the monitoring module 131 may generate an alert, notification, email, and / or other information of the predicted anomaly to an administrator of the monitored system so that the administrator can take preventative measures (e.g., allocating and / or provisioning additional resources for the entity's use before the entity's resource utilization causes a failure or outage).

[0057] The workload forecasting module 160 includes a staleness determination module 162 that performs recursive analysis of a selected model to determine whether the model is stale. After a period of time has passed since training a given time series model, using it to generate predictions, and / or predicting anomalies, the training module 150 retrains the time series model using more recent time series data from the corresponding entity. For example, the training module 150 may regularly obtain and / or generate new training data sets 151 and test data sets 152 from baselines collected over recent days, weeks, months, and / or other periods. The training module 150 may use the new training data sets 151 to generate a set of time series models 176 with various combinations of parameter values, and may use the new test data sets 152 to evaluate the accuracy of the generated time series models 176. The training module 150 may then select one or more of the most accurate and / or best time series models for storage in a model repository and / or use by the monitoring module 131 in generating predictions and / or predicting anomalies for the entity over subsequent time periods.

[0058] Predicting resource utilization, computing workloads, and / or other metrics associated with an entity's use of the monitored system enables resource management system 130 to prevent potential errors, failures, and / or outages in the monitored system, thereby reducing downtime in the monitored system and / or improving the performance of applications, databases, servers, virtual machines, physical machines, and / or other components on the monitored system. Predicting metrics at various granularity and / or technical levels in the monitored system also enables more accurate characterization of resource usage by entities, thereby reducing inefficient allocation of resources to entities and / or inefficient provisioning of resources to meet the entity's requirements. As a result, the systems of FIGS. 1A-1C enable improved use of techniques and / or computer systems for monitoring, managing, and / or allocating computing resources.

[0059] In one or more embodiments, resource management system 130 may include more or fewer components than those shown in FIGS. 1A-1C. For example, training module 150 and monitoring module 131 may be mutually inclusive, mutually interoperable, or mutually exclusive. The components shown in FIGS. 1A-1C may be local or remote to one another. The components shown in FIGS. 1A-1C may be implemented in software and / or hardware. Each component may be distributed across multiple applications and / or machines. Multiple components may be combined into a single application and / or machine. Operations described with respect to one component may alternatively be performed by another component.

[0060] Additional embodiments and / or examples of computer networks are described below in Section 6, "Computer Networks and Cloud Networks."

[0061] In one or more embodiments, the data repository (e.g., data repository 170) is any type of storage unit and / or device for storing data (e.g., a file system, a database, a collection of tables, or any other storage mechanism). The data repository may be implemented or configured to run on the same computing system as the training module 150, the workload prediction module 160, and the monitoring module 131, or on a computing system separate from the training module 150, the workload prediction module 160, and the monitoring module 131. The data repository may be communicatively coupled to the training module 150, the workload prediction module 160, and the monitoring module 131 via a direct connection or a network. Furthermore, the data repository may include multiple different storage units and / or devices. The multiple different storage units and / or devices may or may not be of the same type and may or may not be located at the same physical site.

[0062] In one or more embodiments, resource management system 130 represents hardware and / or software configured to perform the operations described herein for predicting computing workloads, examples of which are described below.

[0063] In one embodiment, resource management system 130 is implemented on one or more digital devices. The term "digital device" generally refers to any hardware device that includes a processor. A digital device may also refer to a physical device that runs applications or virtual machines. Examples of digital devices include computers, tablets, laptops, desktops, notebooks, servers, web servers, network policy servers, proxy servers, general-purpose machines, function-specific hardware devices, hardware routers, hardware switches, hardware firewalls, hardware network address translators (NATs), hardware load balancers, mainframes, televisions, content receivers, set-top boxes, printers, mobile phones, smartphones, personal digital assistants ("PDAs"), wireless receivers and / or transmitters, base stations, communication management devices, routers, switches, controllers, access points, and / or client devices.

[0064] In one or more embodiments, user interface 140 represents hardware and / or software configured to facilitate communication between a user and resource management system 130. User interface 140 provides user interface elements and accepts input via user interface elements. Examples of interfaces include graphical user interfaces (GUIs), command line interfaces (CLIs), tactile interfaces, and voice command interfaces. Examples of user interface elements include check boxes, radio buttons, drop-down lists, list boxes, buttons, toggles, text fields, date and time selectors, command lines, sliders, pages, and forms.

[0065] In one embodiment, different components of the user interface 140 are defined in different languages. The behavior of the user interface elements is defined in a dynamic programming language such as JavaScript. The content of the user interface elements is defined in a markup language such as HyperText Markup Language (HTML) or XML User Interface Language (XUL). The layout of the user interface elements is defined in a style sheet language such as Cascading Style Sheets (CSS). Alternatively, the user interface is defined in one or more other languages, such as Java, C, or C++.

[0066] 3. Multi-layered forecasting of computational workloads 2 illustrates an exemplary set of operations for multi-layer prediction of a computational workload, according to one or more embodiments. One or more of the operations illustrated in FIG. 2 may be modified, rearranged, or omitted altogether. Thus, the particular order of the operations illustrated in FIG. 2 should not be construed as limiting the scope of one or more embodiments.

[0067] The system determines entity attributes of the entities utilizing the computing resources (operation 204). For example, the entity attributes may be retrieved from a data repository and / or received in a request. The entity attributes may include a level of granularity associated with the component utilizing the computing resources (e.g., virtual machine, database, application, application server, database server, transaction, etc.), criteria describing utilization of the computing resources (e.g., processor, memory, network, I / O, storage, and / or thread pool usage), and / or a user or organization representing a customer or owner of the component. The entity attributes may also describe a topology associated with a particular workload at a specified level of granularity.

[0068] For example, the system may receive a request to perform workload prediction for a particular virtual machine. The request may specify a granularity level of node type. In other words, the system initiates the prediction operation by identifying any nodes associated with the virtual machine's performance and analyzing the node's workload. Depending on the request and the specified granularity level, the system may identify (a) the target node hosting the target virtual machine and (b) sibling nodes that are part of the same node cluster as the target node. According to alternative embodiments, the request may specify a granularity level of processing components. Thus, the system may identify processor core and memory access request attributes associated with the processors and memory of the node supporting the particular virtual machine workload. Determining entity attributes may include (a) identifying the workload of the target node and sibling nodes, and (b) determining hardware, such as CPU attributes, processor core attributes, and memory attributes, associated with both the target node and sibling nodes. According to one or more embodiments, the system determines the granularity level for analyzing and predicting the workload based on a setting associated with the prediction operation. The level of granularity may be specified in a request generated by a user via a user interface, or may be specified in a storage configuration associated with a particular user, a particular node, a particular node cluster, and / or a particular virtual machine.

[0069] The entity attributes are matched against a time series model trained on the entity's historical time series data (act 206). For example, the entity attributes may be used as a key to look up the time series model in a model repository and / or in an environment in which the time series model is deployed. As an example, a set of entity attributes may represent an entity topology at a particular level of granularity, such as four nodes in a node cluster, where each node includes eight processors, three nodes include processors of type A with X processor cores each, and one node includes processors of type B with Y processor cores each. Another more general level of granularity associated with the entity topology may include one node running a virtual machine and accessing a database of type D and one sibling node in the same node cluster. The system compares the specified topology against stored topologies, each associated with a stored time series model trained on the respective topology's historical time series data.

[0070] A prediction of the entity's utilization of the computational resources is then generated by applying the time series model to the entity's additional time series data (act 208). For example, the entity's most recently collected utilization metrics are input to the time series model, and the time series model generates an output representing a prediction of future values ​​of the utilization metrics.

[0071] The prediction is output in association with the entity (act 210). For example, the predicted future values ​​may be displayed and / or output in a chart, table, log, file, and / or other representation. A representative of the entity and / or a manager of the computing resources may then use the predicted future values ​​to adjust allocation of resources to the entity and / or provision additional resources to the resources in anticipation of increased workload.

[0072] Operations 202-208 may be repeated for other entities utilizing the computational resources. For example, a time series model may be retrieved for each entity utilizing resources in a cloud and / or distributed system, and a forecast of the entity's resource utilization may be generated and output to facilitate subsequent resource management, allocation, and / or provisioning.

[0073] 3 illustrates an example set of operations for multi-layer prediction of workloads of entities in a system, according to one or more embodiments. One or more of the operations illustrated in FIG. 3 may be modified, rearranged, or omitted altogether. Thus, the particular order of the operations illustrated in FIG. 3 should not be construed as limiting the scope of one or more embodiments.

[0074] The system receives a request to predict the workload of a particular system entity (operation 302). A system entity comprises a particular set of system computing resources at a particular level of granularity. Examples of system entities include virtual machines, nodes that host virtual machines, node clusters to which the host nodes belong, hardware and software that execute tasks to execute workflows, databases, node clusters that support databases, applications, and clusters of nodes that support one or more applications.

[0075] In an exemplary embodiment in which the entity is a virtual machine, the virtual machine generates a workload of tasks performed by processing and memory components from running on an underlying node or server. The system receives a request to predict future characteristics of the virtual machine's workload. For example, the prediction may include bandwidth utilized on the network infrastructure, processing and CPU utilization, memory requests, and access requests to shared resources, such as databases, that the target node and one or more additional nodes may access.

[0076] The system identifies a target entity associated with the workload identified in the prediction request (operation 304). The target entity is associated with a level of granularity associated with the prediction request. For example, the prediction request may include a request to predict the workload of a virtual machine. The request may be associated with a level of granularity that specifies attributes of a server in a server cluster that hosts the virtual machine. The system may determine that the virtual machine is maintained by a particular node of a node cluster. Although from the client device's perspective, the request is sent to a particular address associated with a master node or load balancer of the node cluster, the system identifies the particular node in the cluster to which the master node or load balancer sends the request as the target entity associated with the prediction request.

[0077] The system determines whether the target workload identified in the prediction request is part of a clustered workload (operation 306). A clustered workload is a workload executed by one or more nodes in a node cluster. One or more nodes may each execute separate workloads. The separate workloads may correspond to tasks of the same workload or to tasks of different workloads. For example, one node may execute a workload associated with a virtual machine, while another node may execute a workload associated with a different virtual machine. Alternatively, two nodes may execute workloads that are part of the same virtual machine workload.

[0078] If the system determines that the target workload is not part of a workload cluster, it generates a workload forecast for the target workload in response to a request to generate a forecast for the target entity workload (operation 308). The system generates a forecast for the target workload by applying a time series model trained on a set of attributes associated with the target entity to time series attribute data from the target entity. The system generates a forecast for the target entity that includes not only a forecast based on predicted workload attributes of a request workload associated with the target entity, but also predicted workload attributes of any other operations performed by the target entity. For example, if the target entity is a node that hosts a virtual machine, the system generates a forecast for the node that includes not only a forecast based on predicted workload attributes of a request workload associated with the virtual machine, but also predicted workload attributes of any other operations performed by the node that hosts the virtual machine.

[0079] A particular node may host multiple virtual machines corresponding to one or more tenants. For example, a server may be partitioned to provide access to computing and / or memory resources to different tenants. This partitioning may designate specific processing and / or memory resources for different tenants at all times. Alternatively, the partitioning may include designating times at which tenants can access shared resources at different times. During certain periods, one tenant may be granted access to a set of processing resources, while during other periods, another tenant may be granted access to the same set of processing resources. In addition to virtual machines, a node may provide access to operating systems and applications. The operating systems and applications may be provided to external client devices as part of the virtual machines or separately from the virtual machines. Thus, the operation of other applications executed by the node, such as workflows associated with additional virtual machines, affects the target workload associated with the target virtual machine. According to one example, the system generates and presents (a) a forecast of the target workload associated with the target virtual machine and (b) at least one additional forecast associated with at least one additional workload associated with at least one additional virtual machine hosted by the target node.

[0080] If the system determines that the target workload is part of a workload cluster, it identifies additional workloads in the workload cluster (operation 310). A workload cluster may include a set of workloads executed by two or more nodes in a node cluster. The two or more nodes may include, for example, servers having separate processors and memory and capable of executing workloads independently of each other. The system may determine a relationship between the target workload and any additional workloads in the workload cluster. For example, the system may determine whether the nodes executing the workloads communicate with each other. The system may determine whether the nodes executing the workloads access the same set of shared resources. The system may determine whether a node is designated to take over the tasks of another node in the event of a failure. The system may identify any master nodes in the node cluster executing the workload cluster. The system may further identify any load balancers that distribute requests among the nodes in the cluster executing the workload cluster.

[0081] According to one embodiment, the system analyzes time series data of the target entity associated with the target workload and one or more sibling entities associated with the sibling workload to identify the extent to which the execution of the sibling workload impacts the execution of the target workload (operation 312). For example, sibling nodes in a node cluster may be subject to frequent communication failures, causing periodic increases in workflow to the target node when a master node transfers tasks from the sibling node to the target node. Furthermore, frequent access requests to a shared database by the sibling node for the execution of the sibling workload may cause delays in the target node's attempts to access the shared database for the target workload. The system may determine whether the impact of the sibling workload on the target workload exceeds a threshold. For example, the system may calculate, based on historical time series data, whether a characteristic or event associated with the sibling workload causes the performance of the target workload to degrade by more than 10% at least once in a specified period (e.g., one day, one week, one month, etc.).

[0082] If the system determines that the sibling workload will not affect the operation of the target workload by more than a threshold level, it generates and presents a workload forecast for the target workload without generating workload forecasts for the sibling workloads (operation 308). As described in connection with FIG. 2, generating a workload forecast includes selecting a time-series forecast model based on entity attributes, in other words, entity topology. Generating a workload forecast for the target workload without generating workload forecasts for the sibling workloads may include omitting sibling nodes in a node cluster running the clustered workload from the entity attributes when selecting a time-series forecast model.

[0083] If the system determines that the sibling workload will affect the operation of the target workload beyond a threshold level, it generates a workload forecast for the target workload of the sibling workload (operation 314). Generating the workload forecast for the target workload and the sibling workload includes obtaining entity attributes of the target entity associated with the target workload and the sibling entity associated with the sibling workload. For example, the system may generate separate forecasts for each target node and sibling node in a node cluster running the workload cluster. Presenting the separate forecasts provides a visual indicator of the relationship between the sibling node workflow and the target node workflow. According to an alternative embodiment, generating the workload forecast for the target workload and the sibling workload includes generating a single forecast based on combined entity attributes of the target entity and the sibling entity. As described in connection with FIG. 2 , generating the workload forecast includes selecting a time series forecast model based on entity attributes, in other words, entity topology. In an exemplary embodiment in which the target entity is a node hosting virtual machines, generating the workload forecast for the target entity and the sibling entity includes generating a workflow forecast for the target node based on entity attributes associated with the target node and generating a workflow forecast for at least one sibling node based on entity attributes associated with the sibling node. While the target node and sibling nodes may share some entity attributes (such as attributes of shared resources and interconnected master nodes or load balancers), other entity attributes are unique to each of the target node and sibling nodes. For example, the target node has a specific configuration of processors and memory, separate from its sibling nodes. Thus, the system may select one time series prediction model to predict the workflow of the target node and another time series prediction model to predict the workflow of the sibling nodes.

[0084] The system presents a workload forecast for the target entity and one or more sibling entities (operation 316). For example, the forecasted future values ​​may be displayed and / or output in a chart, table, log, file, and / or other representation. Representatives of the entities and / or administrators of the computing resources may then use the forecasted future values ​​to adjust allocations of resources to the entities and / or provision additional resources to resources in anticipation of increased workload.

[0085] 3. Time series analysis to forecast compute workloads 4 is an example set of operations for performing a time series analysis to forecast a computational workload, according to one or more embodiments. In one or more embodiments, one or more of these steps may be omitted, repeated, and / or performed in a different order. Thus, the specific arrangement of steps shown in FIG. 4 should not be construed as limiting the scope of the embodiments.

[0086] Initially, a resource management system of a monitored system retrieves historical time series data including metrics collected from the monitored system (operation 402). The resource management system may retrieve historical time series data for a given entity (e.g., a combination of customer, metric, and level of granularity) from a data repository. For example, the resource management system may match entity attributes of the entity with records that store historical time series data for the entity in a database (e.g., metrics collected from the entity over the past week, month, year, and / or other time periods). Each record may include a value for the metric, a timestamp representing the time the value was generated, and / or an indicator representing the value's position in the time series.

[0087] The resource management system trains at least one time series model on the historical data (act 404).

[0088] 5 illustrates a process by which a resource management system trains a time series model on historical data. In one or more embodiments, one or more of these steps may be omitted, repeated, and / or performed in a different order. Thus, the specific arrangement of steps illustrated in FIG. 5 should not be construed as limiting the scope of the embodiments.

[0089] The resource management system divides historical time series data into training and test data sets to train a set of time series models (operation 502). For example, the resource management system may prepare a training data set with a majority (e.g., 70-80%) of the time series data and a test data set with the remainder of the time series data. In some embodiments, the resource management system selects the size of the test data set to represent the prediction range of each time series model, as determined by the granularity of the time series data. For example, the resource management system may include in the test data set 24 observations spanning one day of data collected hourly, 7 observations spanning one week of data collected daily, and / or 4 observations spanning approximately one month of data collected weekly. The resource management system optionally generates multiple training and test data sets from the same time series data using cross-validation techniques.

[0090] The resource management system performs an adjustment operation to narrow down the number of models to analyze (operation 504). In one embodiment, the resource management system utilizes an autocorrelation function (ACF) or a partial autocorrelation function (PACF) to explore the many autoregressive terms used by the time series models. For example, using an autocorrelation function, a set of time series data is copied and the copies are adjusted to lag behind the original set of time series data. By comparing the original set of time series data with multiple copies with different lag times, the system identifies a set of parameter values ​​for the time series model that is likely to result in the most accurate forecast.

[0091] By performing adjustment operations, the resource management system determines whether the historical data contains seasonal patterns (operation 506), multi-seasonal patterns (operation 508), trends (operation 510), and outliers or shocks (operation 512). Based on the identified characteristics of the historical time series data, the resource management system selects a particular time series model that is likely to fit the historical data. For example, the system may calculate an ACF / PACF to identify time series model parameters that are most likely to result in accurate predictions. Therefore, the calculation of the ACF and / or PACF filters time series model parameters to reduce the number of iterations the system tests to predict future workflow values. This filtering technique reduces the number of time series models (p, d, q, P, D, Q, f) and their respective parameters in combination with SARIMAX-type models that are trained on the historical data. The system may select from multiple different types of models trained on the historical data, and the different types of models may be fit to the training dataset being evaluated. For example, the system calculates the ACF / PACF to determine that both ARIMA-type and SARIMAX-type models are similarly likely to fit historical data. This automation reduces the overall time it takes to calculate and execute forecast results.

[0092] Upon identifying one or more types of models as potentially fitting the historical data, the resource management system fits multiple versions of the selected time series model to the training dataset (operation 514). Specifically, the resource management system uses the training dataset to train a set of time series models with different parameters (operation 516). For example, the system may use a Box-Jenkins method and / or another method to generate a search space of parameters for different ARIMA-type and / or TBATS-type models. In one embodiment where an ARIMA-type model is selected to fit the training dataset, there are parameters (p, d, q), and the resource management system identifies a search space of parameters using different values ​​of the parameters. The resource management system then fits each model to the training dataset using maximum likelihood estimation (MLE), ordinary least squares (OLS), and / or another technique.

[0093] After generating a set of time series models from the training dataset, the resource management system evaluates the performance of each model using the test dataset (operation 516). In particular, the resource management system uses the time series models to generate predictions of values ​​in the test dataset based on past observations in the time series data. The resource management system also determines the accuracy of the time series models based on a comparison of the predictions and corresponding values ​​in the test dataset. For example, the resource management system calculates the mean squared error (MSE), root mean square error (RMSE), AIC, and / or another measure of model quality or accuracy between the predictions and the corresponding test dataset values ​​for all time series models generated from the entity's historical time series data.

[0094] In one embodiment, the time series model includes an exogenous variable that represents spikes or outliers in the historical data. In one embodiment, future data points predicted by the time series model do not include any influence of the exogenous variable. In an alternative embodiment, future data points predicted by the time series model include the influence of the exogenous variable by accepting values ​​of the exogenous variable as inputs. Additionally or alternatively, in one embodiment, the time series model includes the influence of the exogenous variable on future data points predicted by the initial time series model by reducing the weight given to the exogenous variable relative to other variables in the initial time series model that represent seasonal patterns in the historical data.

[0095] In one embodiment, the resource management system determines the accuracy of the time series models using a Fourier transform of the time series models. The resource management system may determine the accuracy of each time series model by applying a Fourier transform to the time series models and comparing the time series models to a test data set.

[0096] Finally, the resource management system generates a selection of one or more time series models to use in evaluating subsequent time series criteria for the same entity (operation 518). For example, the resource management system includes in the selection one or more time series models that have the highest accuracy in predicting values ​​in the test data set.

[0097] After one or more best time series models are selected for one or more entities, the resource management system stores the parameters of each model in a model repository. Additionally or alternatively, the resource management system provides a representation of the model to a monitoring module, a user interface, and / or other components of the resource management system. In one or more embodiments, the best time series model includes components that represent seasonality, multi-seasonality, trends, and shocks or outliers in the historical time series data. These time series model components improve the accuracy of the model and enable the model to adapt to various types of time series data collected from the monitored system. In one embodiment, the time series model includes exogenous variables that represent outliers in the historical time series data so that outliers in the model generated with the historical time series data do not affect the baseline values ​​in the resource management system's predictions.

[0098] In one embodiment, the resource management system applies a Fourier transform to the time series model, for example, if multiple seasons are detected in the time series, seasonal patterns can be represented using Fourier terms.

[0099] 4, in one or more embodiments, the system uses the selected time series model to generate a time-series-based forecast (operation 406). For example, the system may forecast workload and / or utilization associated with processors, memory, storage, networks, I / O, thread pools, and / or other types of resources in the monitored system.

[0100] To generate a forecast, the system inputs the most recent collection of time series for each entity into a corresponding time series model, which then outputs a forecast of future values ​​in the time series as the predicted workload, resource utilization, and / or performance associated with the entity.

[0101] The system may additionally include functionality for predicting anomalies based on a comparison of the predictions to corresponding thresholds. For example, the thresholds may represent limits on resource utilization by the entity and / or service level objectives for performance metrics associated with the entity. If the predicted metrics violate (e.g., exceed) the corresponding thresholds, the system may detect potential future anomalies, errors, outages, and / or failures in the operation of hardware and / or software resources associated with the entity.

[0102] If an anomaly is predicted in the metric for a given entity, the system communicates the predicted anomaly to one or more users involved in managing the entity's use of the monitored system. For example, the system may include a graphical user interface (GUI), a web-based user interface, a mobile user interface, a voice user interface, and / or another type of user interface that displays a plot of the metric as a function of time. The plot may additionally include a representation of one or more thresholds for the metric and / or the predicted value of the metric from a time series model of the corresponding entity. If the predicted value violates a given threshold, the user interface may display highlighting, coloring, shading, and / or another indicator of the violation as a prediction of a future anomaly or problem in the entity's use of the monitored system. In another example, the monitoring module may generate an alert, notification, email, and / or other information of the predicted anomaly to an administrator of the monitored system so that the administrator can take preventative measures (e.g., allocating and / or provisioning additional resources for the entity's use before the entity's resource utilization causes a failure or outage).

[0103] The system continues to monitor the time series model used to predict future baselines for the entity to determine whether the model is stale (operation 408). The system determines that the time series model is stale if the error rate exceeds a predetermined threshold or if a predetermined amount of time has passed. According to one embodiment, the system determines that the time series model is stale if the root mean square error (RMSE) is below 95% accuracy. Alternative embodiments include any desired accuracy level for the time series model. Additionally or alternatively, the system may determine that the time series model is stale if more than two weeks have passed since training. While weekly units are provided as an example of a timetable for determining whether a time series model is stale, embodiments may include any time period and may be adjusted according to the historical data and the granularity of the prediction.

[0104] After a period of time has passed since training a given time series model, using it to generate predictions, and / or predicting anomalies, the system retrains the time series model using more recent time series data from the corresponding entity (operation 402). For example, the system may regularly obtain and / or generate new training and test data sets from criteria collected over recent days, weeks, months, and / or another period of time. The system may use the new training data sets to generate a set of time series models with various combinations of parameter values, and the new test data sets to evaluate the accuracy of the generated time series models. The system may then select one or more of the most accurate and / or best time series models for storage in a model repository and / or use by the monitoring module in generating predictions and / or predicting anomalies for the entity over subsequent periods of time.

[0105] If the system determines that the time series models are not stale, the resource management system obtains new collection criteria for each entity's time series (operation 410). The system provides the new collection criteria to the time series models to predict new future values ​​(operation 412).

[0106] 4. Anomaly Detection Using Predictive Compute Workload 6 is a flowchart of anomaly detection using predicted computational workloads, according to one or more embodiments. In one or more embodiments, one or more of the steps may be omitted, repeated, and / or performed in a different order. Thus, the specific arrangement of steps shown in FIG. 6 should not be construed as limiting the scope of the embodiments.

[0107] First, the resource management system selects a version of the time series model that best predicts the baseline from multiple versions of the time series model fitted to historical time series data, including the baseline, collected from the monitored system (operation 602). For example, this version may be selected from multiple versions that represent different combinations of parameters used to generate the time series model.

[0108] The resource management system then applies the selected version to additional time series data collected from the monitored system to generate predictions of future values ​​from the baseline (operation 604). For example, the selected version generates predictions based on past observed values ​​of the baseline.

[0109] The resource management system monitors the predicted metric to detect when the predicted metric violates a predetermined threshold (operation 606). If the predicted result violates a predetermined threshold associated with the metric, the resource management system generates an indication of a predicted anomaly in the monitored system (operation 608). For example, the predicted future value is compared to a threshold representing an upper limit for the metric (e.g., 80% resource utilization). If some or all of the predicted future value exceeds the threshold, an alert, notification, and / or other information of the violated threshold is generated and sent to an administrator of the monitored system.

[0110] 5. Exemplary Embodiments For clarity, detailed examples are described below. The following components and / or operations should be understood as a specific example and may not be applicable to certain embodiments. Therefore, the following components and / or operations should not be construed as limiting the scope of the claims.

[0111] 7A-7D illustrate an exemplary embodiment of a system 700 for performing multi-layer workload prediction for a monitored computing system 710. The monitored computing system 710 comprises a node cluster including a node 712 and a node 713. Node 713 is the master node in the cluster, receiving incoming requests and instructions and distributing tasks to a designated node 712 or 713. Both nodes 712 and 713 access resources from a shared database 711. Node 712 hosts a virtual machine 716 on which a client device 720 executes one or more applications. The virtual machine 716 is associated with a workload 718 defined by tasks required for the operation of the virtual machine 716. The node 712 is associated with a workload 714 defined by tasks required for the execution of operations on the node 712. Node workload 714 includes virtual machine workload 718 as well as performing backend operations, running applications that virtual machine 716 does not have access to, running operating systems that virtual machine 716 does not have access to, and / or any other tasks necessary to run a virtual machine or application in a partition of node 712 that virtual machine 716 does not have access to. Node 713 hosts virtual machine 717. Virtual machine 717 is associated with workload 719. Node 713 is associated with workload 715. Node workload 715 includes virtual machine workload 719 as well as performing backend operations, running applications that virtual machine 717 does not have access to, running operating systems that virtual machine 717 does not have access to, and / or any other tasks necessary to run a virtual machine or application in a partition of node 713 that virtual machine 717 does not have access to.

[0112] The resource management system 730 monitors the operation of the computing system 710 and generates workload forecasts associated with the computing system 710. In particular, the resource management system 730 generates workload forecasts based on time series models at particular levels of granularity. A lower level of granularity may include forecasting the workload of a virtual machine. A higher level of granularity may include forecasting the workload of an underlying node running the virtual machine. An even higher level of granularity may include forecasting the workload of sibling nodes in a node cluster that includes the target node that hosts the target virtual machine.

[0113] Referring to FIG. 7A , resource management system 730 receives, via user interface 750, a request 751 to initiate a workload forecast associated with virtual machine workload 718. A workload forecast is a prediction of workload values ​​at a future time. Resource management system 730 retrieves (752) topology data based on the granularity associated with the request. In the exemplary embodiment of FIG. 7A , system 730 is configured to provide a forecast at a default level of granularity unless request 751 specifies a different level of granularity. Request 751 specifies a high level of granularity that includes the computing workload of processors in nodes 712 and / or 713 associated with virtual machine 716. Resource management system 730 retrieves topology data 741 associated with computing system 710 from data repository 740. Topology data 741 includes entity attributes associated with computing system 710. The entity attributes specify that computing system 710 comprises a shared database 742, a node cluster 743, nodes 744 in the node cluster (i.e., nodes 712 and 713), CPU data for each node 745, processor cores for each CPU 746, and node memory data for each node 747. The node data 744 includes the processing capacity, memory capacity, processor type, and memory type of the processors and memory devices in each node.

[0114] 7B , resource management system 730 identifies (753) node 712 that hosts target virtual machine 716 associated with workload prediction request 751 based on topology data 741. Resource management system 730 identifies attributes of node 712, including processing attributes, bandwidth attributes, and memory capacity attributes. Resource management system 730 further determines (754) that node 712 is part of a node cluster that includes nodes 712 and 713. Based on the level of granularity associated with request 751, resource management system 730 determines whether to fulfill request 751 with only the workload prediction for node 712 or with the workload predictions for both nodes 712 and 713. To do so, resource management system 730 retrieves historical workload data 748 for nodes 712 and 713 to determine whether the operation of node 713 is affecting the operation of node 712 at a level that exceeds a threshold level. In particular, the system determines whether, in a set of time series data associated with a one-hour period over a one-week period, a correlation exists between the behavior of node 713 and a degradation in the performance of node 712 of more than 10%. For example, if the time series data indicates that node 712 is utilizing 60% of its processing capacity in one time interval, and a subsequent time interval shows a spike in node 713's processing capacity, and a subsequent time interval shows node 712's processing capacity utilization increasing to 70%, then system 730 may determine that node 713 is affecting node 712 at a level that exceeds a threshold level.

[0115] Based on determining that the workload of the sibling node will impact the workload of the target node above a threshold level, resource management system 730 retrieves entity attributes associated with the sibling node. In particular, based on the initial request, system 730 retrieves entity attributes (such as processor and memory data) associated with node 712, which hosts virtual machine 716. Based on determining that the workload of node 713 will impact the workload of node 712 above a threshold level, system 730 retrieves entity attributes of sibling node 713.

[0116] 7C , the resource management system 730 matches attributes of the target node with a time-series workload forecasting model associated with the attributes based on the topology data (757). For example, a particular time-series workload forecasting model may be stored in association with a set of attributes (database type U, node cluster type V, node type W, CPU type X, processor type Y, processor core YY, memory type Z, memory capacity ZZ). The system 730 matches identifying attributes of the target node 712 with the time-series workload forecasting model. Similarly, the system 730 matches identifying attributes of sibling nodes 713, whose attributes differ from those of the target node 712, with different time-series workload forecasting models (758).

[0117] The system 730 obtains 759 current time-series workload data associated with the target node and sibling nodes. The system 730 may obtain the current time-series workload data by monitoring the operation of the computing system 710. Alternatively, the system 730 may obtain the most recently generated time-series workload data associated with nodes 712 and 713 from the data repository 740.

[0118] The system applies the time-series workload prediction model to the time-series workload data associated with the target node 712 and sibling nodes 713 to generate time-series workload predictions for the target node 712 and sibling nodes 713 (760).

[0119] 7D , system 730 presents the forecast in graph 762 on user interface 750. Graph 762 includes a visual indicator 763 of the portion of the forecasted time-series workload data where the workload of one or both of nodes 712 and 713 exceeds a threshold. According to an exemplary embodiment, graph 762 includes workload data for both node 712 and virtual machine 716. In particular, because request 751 is directed to a forecast for workload 718 associated with virtual machine 716, the graph includes a forecast for workload 718 associated with virtual machine 716. However, because the workload of virtual machine 716 is affected by node workload 714 and node workload 715, resource management system 730 presents additional forecasts associated with workloads 714 and 715 to provide the user with the information necessary to modify or reconfigure the functionality of computing system 710.

[0120] Based on the data shown in graph 762, an operator, through interaction with user interface 750, generates instructions 761 for reconfiguring computing system 710. For example, instructions 761 may include instructions to add one or more additional nodes to a node cluster, instructions to forward a particular request from a particular client to a different node in a node cluster, or instructions to schedule the replacement of one node type in a node cluster with another node type having improved node attributes.

[0121] 6. Computer Networks and Cloud Networks In one or more embodiments, a computer network provides connectivity among a set of nodes. The nodes may be local and / or remote from one another. The nodes are connected by a set of links. Examples of links include coaxial cable, unshielded twisted cable, copper cable, optical fiber, and virtual links.

[0122] A computer network is implemented by a subset of nodes. Examples of such nodes include switches, routers, firewalls, and network address translators (NATs). Another subset of nodes uses the computer network. Such nodes (also called "hosts") may run client processes and / or server processes. A client process requests a computing service (such as running a particular application and / or storing a particular amount of data). A server process responds by performing the requested service and / or returning the corresponding data.

[0123] A computer network may be a physical network including physical nodes connected by physical links. A physical node may be any digital device. A physical node may be a function-specific hardware device such as a hardware switch, a hardware router, a hardware firewall, and a hardware NAT. Additionally or alternatively, a physical node may be a general-purpose machine configured to run various virtual machines and / or applications that perform respective functions. A physical link is a physical medium connecting two or more physical nodes. Examples of links include coaxial cable, unshielded twisted cable, copper cable, and optical fiber.

[0124] A computer network may be an overlay network. An overlay network is a logical network implemented on top of another network (e.g., a physical network). Each node in an overlay network corresponds to a respective node in the underlying network. Thus, each node in an overlay network is associated with both an overlay address (which addresses the overlay node) and an underlay address (which addresses the underlay node that realizes the overlay node). An overlay node may be a digital device and / or a software process (e.g., a virtual machine, an application instance, or a thread). Links connecting overlay nodes are implemented as tunnels through the underlying network. Overlay nodes at either end of the tunnel treat the underlying multi-hop path between them as a single logical link. Tunneling is performed by encapsulation and decapsulation.

[0125] In one embodiment, a client may be local and / or remote to a computer network. A client may access the computer network through a private network or another computer network, such as the Internet. A client may communicate requests to the computer network using a communication protocol, such as the Hypertext Transfer Protocol (HTTP). Requests are communicated through an interface, such as a client interface (e.g., a web browser), a program interface, or an application programming interface (API).

[0126] In one embodiment, a computer network provides connectivity between clients and network resources. The network resources include hardware and / or software configured to run server processes. Examples of network resources include processors, data storage, virtual machines, containers, and / or software applications. The network resources are shared among multiple clients. The clients request computing services from the computer network independently of each other. The network resources are dynamically allocated on demand to requests and / or clients. The network resources allocated to each request and / or client can scale up or down based on, for example, (a) the computing services requested by a particular client, (b) the aggregate computing services requested by a particular tenant, and / or (c) the aggregate computing services required by the computer network. Such a computer network may be referred to as a "cloud network."

[0127] In one embodiment, a service provider offers a cloud network to one or more end users. The cloud network may enable various service models, including, but not limited to, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). In SaaS, the service provider offers end users the ability to use the service provider's applications running on network resources. In PaaS, the service provider offers end users the ability to deploy custom applications on the network resources. Custom applications can be created using programming languages, libraries, services, and tools supported by the service provider. In IaaS, the service provider offers end users the ability to provision the processing, storage, network, and other functional computing resources provided by the network resources. Any application (including an operating system) may be deployed on the network resources.

[0128] In one embodiment, a computer network may enable various deployment models, including, but not limited to, a private cloud, a public cloud, and a hybrid cloud. In a private cloud, network resources are provisioned for the exclusive use of a specific group of one or more entities (as used herein, the term "entity" refers to an entity such as a company, organization, person, etc.). The network resources may be local and / or remote to the premises of the specific entity group. In a public cloud, cloud resources are provisioned for multiple independent entities (also referred to as "tenants" or "customers"). The computer network and its network resources are accessed by clients corresponding to the various tenants. Such a computer network is sometimes referred to as a "multi-tenant computer network." Multiple tenants may use the same specific network resources at different times and / or the same time. The network resources may be local and / or remote to the tenant's premises. In a hybrid cloud, the computer network comprises a private cloud and a public cloud. An interface between the private cloud and the public cloud enables data and application portability. Data stored in the private cloud and data stored in the public cloud are interchangeable through the interface. Applications running on a private cloud and applications running on a public cloud may depend on each other, and calls from applications on the private cloud to applications on the public cloud (and vice versa) can be made through interfaces.

[0129] In one embodiment, tenants of a multi-tenant computer network are independent of one another. For example, the business or activities of one tenant may be separate from the business or activities of another tenant. Different tenants may have different network requirements for the computer network. Examples of network requirements include processing speed, amount of data storage, security requirements, performance requirements, throughput requirements, latency requirements, resiliency requirements, quality of service (QoS) requirements, tenant isolation, and / or consistency. The same computer network may need to meet different network requirements for different tenants.

[0130] In one or more embodiments, tenant isolation is achieved in a multi-tenant computer network to prevent applications and / or data of different tenants from being shared with each other. Tenant isolation may be achieved using a variety of techniques.

[0131] In one embodiment, each tenant is associated with a tenant ID. Each network resource in a multi-tenant computer network is tagged with a tenant ID. A tenant is granted access to a particular network resource only if the tenant and the particular network resource are associated with the same tenant ID.

[0132] In one embodiment, each tenant is associated with a tenant ID. Each application implemented by the computer network is tagged with a tenant ID. Additionally or alternatively, each data structure and / or dataset stored by the computer network is tagged with a tenant ID. A tenant is granted access to a particular application, data structure, and / or dataset only if the tenant and the particular application, data structure, and / or dataset are associated with the same tenant ID.

[0133] As one example, each database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only the tenant associated with the corresponding tenant ID may access the data in that particular database. As another example, each entry in a database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only the tenant associated with the corresponding tenant ID may access the data in that particular entry. However, a database may be shared by multiple tenants.

[0134] In one embodiment, the registration list indicates which tenants have permission to access which applications. A list of tenant IDs of tenants that are allowed to access the application is stored for each application. A tenant is allowed to access a particular application only if the tenant ID of the tenant is included in the registration list corresponding to the particular application.

[0135] In one embodiment, network resources (such as digital devices, virtual machines, application instances, and threads) corresponding to different tenants are isolated according to tenant-specific overlay networks maintained by a multi-tenant computer network. As an example, packets from any source device in a tenant overlay network can only be sent to other devices within the same tenant overlay network. An encapsulation tunnel is used to prohibit transmission from a source device on a tenant overlay network to a device in another tenant overlay network. Specifically, a packet received from a source device is encapsulated within an outer packet. The outer packet is transmitted from a first encapsulation tunnel endpoint (communicating with the source device in the tenant overlay network) to a second encapsulation tunnel endpoint (communicating with a destination device in the tenant overlay network). The second encapsulation tunnel endpoint decapsulates the outer packet to obtain the original packet sent by the source device. The original packet is transmitted from the second encapsulation tunnel endpoint to the destination device within the same specific overlay network.

[0136] 7. Miscellaneous - Extensions Embodiments are directed to systems having one or more devices that include a hardware processor and are configured to perform any of the operations described herein and / or recited in the claims below.

[0137] In one embodiment, a non-transitory computer-readable medium comprises instructions that, when executed by one or more hardware processors, cause the processor to perform any of the operations described in the specification and / or recited in the claims.

[0138] According to one or more embodiments, any combination of the features and functions described herein may be employed. In the above specification, embodiments have been described with reference to numerous specific details that may vary from embodiment to embodiment. Accordingly, the specification and drawings should be regarded as illustrative rather than limiting. The sole and exclusive indicator of the scope of the invention, and what the applicants intend as the scope of the invention, is the literal and equivalent scope of the set of claims originating from this application in the specific form from which such claims originate, including any subsequent amendments.

[0139] 8. Hardware Overview According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. The special-purpose computing devices may be hardwired to perform the techniques; may include digital electronic devices such as one or more application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or network processing units (NPUs) permanently programmed to perform the techniques; or may include one or more general-purpose hardware processors programmed to perform the techniques according to program instructions in firmware, memory, other storage, or a combination thereof. Such special-purpose computing devices may also implement the techniques using custom hardwired logic, ASICs, FPGAs, or NPUs in combination with custom programming. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices, or any other devices incorporating hardwired and / or program logic to implement the techniques.

[0140] For example, Figure 8 is a block diagram illustrating a computer system 800 upon which one embodiment of the present invention may be implemented. Computer system 800 includes a bus 802 or other communication mechanism for communicating information, and a hardware processor 804 coupled with bus 802 for processing information. Hardware processor 804 may be, for example, a general-purpose microprocessor.

[0141] Computer system 800 also includes a main memory 806 (such as a random access memory (RAM) or other dynamic storage device) coupled to bus 802 for storing information and instructions executed by processor 804. Main memory 806 may also be used for storing temporary variables or other intermediate information during execution of instructions executed by processor 804. When such instructions are stored on a non-transitory storage medium accessible to processor 804, computer system 800 becomes a special-purpose machine customized to perform the operations specified in the instructions.

[0142] Computer system 800 further includes a read-only memory (ROM) 808 or other static storage device coupled to bus 802 for storing static information and instructions for processor 804. A storage device 810, such as a magnetic or optical disk, is provided and coupled to bus 802 for storing information and instructions.

[0143] Computer system 800 may be coupled via bus 802 to a display 812, such as a cathode ray tube (CRT), for displaying information to a computer user. Also coupled to bus 802 is an input device 814, including alphanumeric and other keys, for communicating information and command selections to processor 804. Another type of user input device is a cursor controller 816 (such as a mouse, trackball, or cursor direction keys) for communicating directional information and command selections to processor 804 and for controlling cursor movement on display 812. This input device typically has two degrees of freedom in two axes—a first axis (e.g., x) and a second axis (e.g., y)—allowing the device to specify a position in a plane.

[0144] Computer system 800 may implement the techniques described herein using customized hardwired logic, one or more ASICs or FPGAs, firmware, and / or program logic, which, in combination with a computer system, cause computer system 800 to become or be programmed as a special purpose machine. According to one embodiment, the techniques described herein are performed by computer system 800 in response to processor 804 executing one or more sequences of one or more instructions contained in main memory 806. Such instructions may be read into main memory 806 from another storage medium, such as storage device 810. Execution of the sequences of instructions contained in main memory 806 causes processor 804 to perform the process steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0145] As used herein, the term "storage medium" refers to any non-transitory medium that stores data and / or instructions that cause a machine to operate in a specific manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 810. Volatile media include dynamic memory, such as main memory 806. Common forms of storage media include, for example, floppy disks, flexible disks, hard disks, solid-state drives, magnetic tape, or any other magnetic data storage medium, CD-ROMs, any other optical data storage medium, physical media with patterns of holes, RAM, PROMs, and EPROMs, FLASH-EPROMs, NVRAMs, any other memory chips or cartridges, content addressable memories (CAMs), and ternary content addressable memories (TCAMs).

[0146] Storage media are distinct from but can be used in conjunction with transmission media. Transmission media involves transferring information between storage media. For example, transmission media include coaxial cables, copper wire and fiber optics, including the wires that comprise bus 802. Transmission media can also be forms of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0147] Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor 804 for execution. For example, the instructions may initially be carried on a magnetic disk or solid-state drive of a remote computer. The remote computer may load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 800 receives the data on the telephone line and uses an infrared transmitter to convert the data to an infrared signal. The data carried in the infrared signal can be received by an infrared detector and appropriate circuitry can pass the data to bus 802. Bus 802 carries the data to main memory 806, from which processor 804 retrieves and executes the instructions. The instructions received by main memory 806 may optionally be stored on storage device 801 either before or after execution by processor 804.

[0148] Computer system 800 also includes a communication interface 818 coupled to bus 802. The communication interface 818 provides a two-way data communication coupling to a network link 820 that is connected to a local network 822. For example, communication interface 818 may be an Integrated Services Digital Network (ISDN) card, cable modem, satellite modem, or a modem that provides a data communication connection to a corresponding type of telephone line. As another example, communication interface 818 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. A wireless link may also be implemented. In any such implementation, communication interface 818 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

[0149] Network link 820 typically provides data communication through one or more networks to other data devices. For example, network link 820 may provide a connection through local network 822 to data equipment operated by a host computer 824 or by an Internet Service Provider (ISP) 826. ISP 826, in turn, provides data communication services through the worldwide packet data communication network now commonly referred to as the "Internet" 828. Local network 822 and Internet 828 both use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 820 and through communication interface 818, carrying the digital data to and from computer system 800, are exemplary forms of transmission media.

[0150] Computer system 800 can send messages and receive data, including program code, through the network(s), network link 820 and communication interface 818. In the Internet example, a server 830 might transmit a requested code for an application program through Internet 828, ISP 826, local network 822 and communication interface 818.

[0151] The received code may be executed by processor 804 after it is received, and / or stored in storage device 801, or other non-volatile storage for execution.

[0152] In the foregoing specification, embodiments of the present invention have been described with reference to numerous specific details that may vary from embodiment to embodiment. Accordingly, the specification and drawings are to be regarded as illustrative rather than limiting in any sense. The sole and exclusive indication of the scope of the invention, and what Applicants intend as the scope of the invention, is the literal and equivalent scope of the set of claims originating from this application in the particular form from which such claims originate, including any subsequent amendments.

Claims

1. A non-transitory computer-readable medium comprising instructions that, when executed by one or more hardware processors, cause operations to be performed, said operations including: determining entity attributes of entities utilizing the computational resources; the entity attributes include a particular level of granularity associated with utilization of the computing resource and a criterion describing utilization of the computing resource; The operation is matching the entity attributes with a time series model trained on historical time series data for the entity at the particular level of granularity; applying the time series model to additional time series data for the entity to generate a prediction of the utilization of the computing resource by the entity; the additional time series data includes values ​​of the metric representing the utilization of the computing resource at the particular level of granularity; The operation is and outputting the prediction in association with the entity.

2. The particular granularity level is: a set of physical hardware including a processor that facilitates data communication with the computing resource; Virtual machine workloads; The node workload for the node that hosts the virtual machine; and a database accessed by one or more nodes of a node cluster; a database server that accesses the database; an application executed by one or more nodes of the node cluster; an application server that runs one or more applications accessed by one or more nodes of the node cluster.

3. The criteria are:

10. The non-transitory computer-readable medium of claim 1, comprising at least one of processor usage, processor core usage, memory usage, network bandwidth usage, and I / O usage.

4. Determining entity attributes of the entity includes: Identifying a first computing system component specified in the request to generate a workload forecast; and identifying at least one second computing system component not specified in the request based on the particular level of granularity associated with the request; 2. The non-transitory computer-readable medium of claim 1, wherein applying the time series model to the additional time series data for the entity to generate the prediction of the utilization of the computing resources by the entity comprises applying the time series model to workload data associated with the second computing system component.

5. Matching the entity attributes with the time series model trained on historical time series data of the entity includes: identifying at least one value associated with a first set of computational resources and a criterion associated with said computational resources; accessing a lookup table to identify the at least one value in a particular field of the lookup table; and matching the time series model with the entity attribute by determining that the time series model is mapped to the at least one value in the lookup table.

6. The operation is obtaining a first request to generate a first workload forecast associated with the computing resources utilized by the entity; the first request is associated with a first level of granularity; The operation is receiving a second request to generate a second workload forecast associated with the computing resources utilized by the entity; the second request is associated with a first level of granularity; The operation is generating the first workload forecast for a first set of the computing resources utilized by the entity in response to the first request; generating the second workload forecast for a second set of the computing resources utilized by the entity in response to the second request; The non-transitory computer-readable medium of claim 1 , wherein the second set of computing resources is different from the first set of computing resources.

7. A non-transitory computer-readable medium comprising instructions that, when executed by one or more hardware processors, cause operations to be performed, said operations including: Obtaining a request to generate a workload forecast associated with a particular compute resource; identifying a first set of computing resources utilized by the particular computing resource to execute the workload; identifying a second set of computing resources not utilized by the particular computing resource to execute the workload; and based on determining that execution of operations on the second set of computing resources impacts execution of the workload at a level that exceeds a threshold; a first workload prediction associated with the first set of computing resources; and generating a response to the request comprising: a second workload prediction associated with the second set of computing resources.

8. generating the first workload forecast includes applying a first time-series workload forecast model to a first set of time-series workload data associated with the first set of computing resources; 8. The non-transitory computer-readable medium of claim 7, wherein generating the second workload forecast comprises applying a second time-series workload forecast model to a second set of time-series workload data associated with the second set of computing resources.

9. the workload predictions associated with the particular computing resource include predictions associated with database access requests to a shared database; the first set of computing resources includes at least a first node of a node cluster, the node cluster forwarding the database access request to the shared database; The non-transitory computer-readable medium of claim 7 , wherein the second set of computing resources includes at least a second node of the node cluster.

10. A method comprising the operations of any one of claims 1 to 9.

11. 1. A system comprising: one or more processors; a memory storing instructions that, when executed by said one or more processors, cause said system to perform the operations of any one of claims 1 to 9.

12. A system comprising means for performing the operations of any one of claims 1 to 9.

Images