Health status monitoring for large-scale cloud computing systems

Abstract

Aspects of the present invention disclose methods, computer program products, and systems for monitoring a health status of a computing system. The method includes one or more processors deploying an individual monitoring predictive agent on each of a plurality of worker nodes of the computing system. The method further includes determining, by the individual monitoring predictive agent, a single binary health status value for each of the plurality of worker nodes by comparing a time-dependent function of the performance metric data values ​​of the individual worker nodes to an upper threshold and a lower threshold. The method further includes receiving the binary health status value along with individual identification information from each of the plurality of worker nodes. The method further includes generating a data set indicative of the health status of the computing system by feeding the received individual identification information to a hash function of a Counting Bloom Filter.

Description

[Technical Field]

[0001] The present invention relates generally to the field of computer system analytics, and more particularly to monitoring the health status of computing systems. [Background technology]

[0002] Monitoring IT (Information Technology) infrastructure components has always been a separate IT discipline. With its help, components of the IT landscape of a business or cloud computing environment can be managed efficiently, remotely, and continuously. In addition, potential bottlenecks can be detected early to prevent unplanned downtime of individual components of the IT infrastructure.

[0003] Monitoring as a service (MaaS) is one of many cloud computing delivery models within anything as a service (XaaS). Monitoring as a service is a framework that facilitates the deployment of monitoring functionality for various services and applications within a cloud computing environment. The most common application of MaaS is online status monitoring of IT components, which continuously tracks the specific state of an application, network, system, instance, or any element that may be deployed within a cloud computing environment. Several products currently on the market collect a large amount of status data from IT components over time and in different ways. Typically, this status data is collected in a central location and analyzed in multiple different ways. The overhead involved in such complex status tracking systems, as well as the data analytics required due to the data complexity, can be significant and place additional burdens on (a) the infrastructure components being observed and (b) the central analytical services needed to extract meaning from the large amount of collected data.

[0004] And there is at least one good reason for this: outages in cloud computing systems usually have a direct customer impact. Typically, the service becomes unavailable for a short period of time (seconds to minutes), depending on the incident. Incidents can be anything from network outages to the unavailability of adjacent services (e.g., databases, messaging systems, etc.). Summary of the Invention

[0005] Aspects of the present invention disclose a method, computer program product, and system for monitoring the health status of a computing system. The method includes one or more processors deploying an individual monitoring predictive agent on each of a plurality of worker nodes of the computing system. The method further includes the one or more processors determining, by the individual monitoring predictive agent, a single binary health status value for each of the plurality of worker nodes. The method of determining the individual single binary health status value further includes the one or more processors comparing a time-dependent function of the performance metric data values ​​of the individual worker nodes to predetermined configurable upper and lower thresholds. The method further includes the one or more processors receiving the binary health status value along with individual identification information from each of the plurality of worker nodes. The method further includes the one or more processors generating a dataset indicative of the health status of the computing system by feeding the received identification information of each of the plurality of worker nodes through a hash function of a Counting Bloom Filter.

[0006] It should be noted that embodiments of the present invention are described with respect to different subject matters. In particular, some embodiments are described with respect to method-type claims, while other embodiments are described with respect to apparatus-type claims. However, those skilled in the art will understand from the above and following description that, unless otherwise indicated, all combinations of features belonging to one type of subject matter, as well as all combinations of features relating to different subject matters, particularly between method-type claims and apparatus-type claims, are considered to be disclosed herein.

[0007] The above-defined and further aspects of the invention will be apparent from and will be explained with reference to the example embodiments described hereinafter, to which the invention is not limited. Preferred embodiments of the invention are described, by way of example only, and with reference to the following drawings, in which: [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 2 is a block diagram of one embodiment of a computer-implemented method of the present invention for monitoring the health status of a computing system including multiple worker nodes, in accordance with embodiments of the present invention. [Figure 2] FIG. 1 is a block diagram of one embodiment of an architecture with components supporting the proposed concepts, according to embodiments of the present invention. [Figure 3] FIG. 2 is a block diagram of an embodiment of a Counting Bloom Filter, in accordance with an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram of one embodiment of aspects of the functionality of a monitoring predictive agent, according to an embodiment of the present invention. [Figure 5] 10 is a flowchart of another implementation of a version closer to an embodiment of the overall method according to an embodiment of the present invention. [Figure 6] 10 is a flowchart of another implementation approaching an embodiment of a predictive aspect of the proposed concept, according to an embodiment of the present invention. [Figure 7] 1 is a block diagram of one embodiment of an inventive computing infrastructure monitoring system, in accordance with an embodiment of the present invention. [Figure 8] FIG. 8 is a diagram of one embodiment of a computing system including at least a portion of the computing infrastructure monitoring system of FIG. 7, in accordance with an embodiment of the present invention. [Figure 9] FIG. 1 is a diagram of an embodiment of a cloud computing infrastructure, in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0009] In the context of this description, the following conventions, terms or expressions, or combinations thereof, may be used.

[0010] The term "health status" or health status value may refer to a numerical indicator value that expresses how well a complex system, such as a worker node or computing system, or multiple worker nodes in multiple computing systems, is functioning. In various embodiments, the term "health status" or health status value may indicate a status such as "trouble imminent" or "all systems are running smoothly."

[0011] The term "computing system" may refer to one or more hardware computing systems, clusters, cloud computing centers, or one or more virtual machines or computing containers (e.g., Docker containers), or a combination thereof. A computing system may also be a network or storage system or comparable system. Other peripheral units may also be described as computing systems in the context of the proposed concepts according to various embodiments of the present invention.

[0012] The term "worker node" can refer to a computer system or portion thereof, either virtual or physical. A worker node may be adapted to execute program code. Thus, a virtual machine or a stateless computing container may also be referred to as a worker node. Worker nodes may be deployed in large cloud computing centers, such as in the range of 10,000 or 100,000, or even more.

[0013] The term "monitoring and predicting agent" may refer to functionality within a worker node that has the ability to determine a binary health status value for the worker node. In an exemplary embodiment, the "monitoring and predicting agent" may represent memory usage for the worker node.

[0014] The term "single binary health status value" may represent a logical "0" or a logical "1." In an example embodiment, for an individual worker node, a logical "0" may mean "no problem detected," and a logical "1" may represent "a problem may exist."

[0015] The term "time-dependent function" as used herein may refer to, for example, a PID (proportional-integral-derivative) filter that uses a given set point of consumable memory and actual determined memory usage, thereby also reflecting short-term historical memory consumption values, whereby memory consumption may also be one example of another resource of a worker node.

[0016] The term "performance metric data value" can refer to a real-world numerical data value, or it can represent a specific resource consumption by a computing system involving more computational processes. One example may be the percentage of memory consumed compared to the total memory available. Other performance metric data values ​​may relate to network utilization, or processor utilization, or computer power utilization.

[0017] The term "upper threshold" may refer to a numerical value (e.g., a percentage value) that can be uploaded to the monitoring and predictive agent upon initialization, against which the performance metric value can be compared. Thus, two percentage values ​​can be compared to each other. If the performance metric value can exceed the upper threshold, a logical "1" can be generated as the binary health status value for the individual worker node. The term "lower threshold" may refer to the corresponding threshold value when compared to the upper threshold.

[0018] The term "health management agent" may refer to a central processor or system that controls various aspects of the present invention, taking the place of a Counting Bloom Filter (CBF) for determining the health status of multiple worker nodes. Typically, but not necessarily, a health monitoring agent may be deployed remotely from the worker nodes and may be part of a MaaS solution.

[0019] The term "identification" can refer, for example, to an address label and the corresponding network (e.g., worker node). However, parts of a network address can also be used as identification, such as the virtual machine part of the complete address, the address of the associated hardware system, a cluster address, or a region address.

[0020] The term "hash function" can refer to any function that can be used to map data of any size (e.g., address data) to a fixed-size value. The value returned by a hash function (e.g., an index pointer to an index field in a data array) is called a hash value, hash code, digest, or simply hash.

[0021] The term "Counting Bloom Filter" (CBF) can refer to a generalized data structure of a Bloom filter that can be used to test whether the count of a given element, given a set of elements, is less than a given threshold. As a generalized form of a Bloom filter, false positive matches are possible, but false negatives are not. In other words, a query returns either "probably greater than or equal to the threshold" or "definitely less than the threshold." Here, a hash function maps incoming data (e.g., address data) to a counter that is part of the Bloom filter dataset or data array.

[0022] The term "dataset" may refer to an array of (e.g., integer-valued) fields in an array where logical "1" values ​​increase or decrease depending on the received binary health status value.

[0023] The term "time series" can refer to the persistent storage of data values ​​in comparable data structures to generate time-dependent sets of data for further analysis.

[0024] The term "cloud computing," in this context, can be interpreted as a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. A remote, multi-tenant computing environment may be implemented as a cloud computing data center. The cloud model promotes availability and consists of at least five essential characteristics, three service models, and four deployment models:

[0025] The essential characteristics of cloud computing include: (i) On-Demand Self-Service: Consumers can unilaterally provision computing capabilities, such as server time and network storage, automatically as they are needed without requiring human interaction with each service provider. (ii) Broad Network Access. Functionality is available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs). (iii) Resource Pooling. Provider computing resources are pooled to serve multiple consumers using a multi-tenant model with different physical and virtual resources, dynamically allocated and reallocated according to consumer demand. There is a sense of location independence in that customers generally have no control or information about the exact location of the resources provided, although location may be specified at a higher level of abstraction (e.g., country, state, or data center). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines. (iv) Rapid Scalability. Capabilities can be provisioned quickly and scalably, in some cases automatically, to quickly scale out, quickly release, and quickly scale in. To the consumer, the capabilities available for provisioning often appear unlimited, and any amount can be purchased at any time. (v) Service Metering. Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at several levels of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services used.

[0026] Service models for cloud computing usage include: (i) Cloud Software as a Service (SaaS): The functionality offered to the consumer is the use of the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, except for limited user-specific application configuration settings. (ii) Cloud Platform as a Service (PaaS): The functionality offered to the consumer is the deployment of consumer-created or acquired applications written using programming languages ​​and tools supported by the provider onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration. (iii) Cloud Infrastructure as a Service (IaaS): The functionality offered to consumers is the provisioning of processing, storage, network, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and in some cases limited control over selected networking components (e.g., host firewalls).

[0027] Deployment models for cloud computing include the following: (i) Private Cloud. The cloud infrastructure is operated solely by one organization. The cloud infrastructure may be managed by the organization or a third party and may exist on-premises or off-premises. (ii) Community Cloud. Cloud infrastructure is shared by several organizations to support a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). Cloud infrastructure may be managed by the organization or a third party and may exist on-premises or off-premises. (iii) Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by an organization that sells cloud services. (iv) Hybrid Cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a unique entity, but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0028] Note that cloud software takes full advantage of the cloud paradigm by being service-oriented with a focus on statelessness (with exceptions), low coupling, modularity, and semantic interoperability. This is especially true for worker nodes on or within computing systems deployed in cloud computing centers.

[0029] The proposed computer-implemented method for monitoring the health status of a computing system including multiple worker nodes may provide multiple advantages, contributions, and technical effects.

[0030] Embodiments of the present invention recognize that while recovery or high-availability systems are typically deployed in enterprise-grade IT infrastructures, users may experience outages of a single microservice or a few microservices. From a cloud provider's perspective, this is necessary to prevent such outages as much as possible with minimal effort. However, currently available monitoring services and systems for this purpose may be overly complex and pose a real burden on existing IT infrastructure and its operators. In particular, in environments where 10,000 or even 100,000 services need to be monitored, embodiments of the present invention recognize that more sophisticated, manageable, and highly automated MaaS technologies will be required.

[0031] In contrast to traditional monitoring and system management systems, embodiments of the present invention reduce the health status of a worker node to a single binary health status value (essentially "0" or "1"), thereby requiring as little information as possible and operating without incurring overhead. As discussed above, traditional monitoring systems collect a wide variety of life-power metrics of a computing system, possibly even from running services. The overhead involved can be reduced to a minimal one bit, in terms of memory consumption required on or within the worker node and on or within the analysis system, the bandwidth required to transmit all these parameter values ​​from the worker node to the central analysis system, and the computing capacity required on the central analysis system. Thus, the collection of 100 or even 1,000 or more data points per second by traditional monitoring systems can be avoided by limiting the health status of a worker node to one key data point. This data point or this performance metric data value can be the memory consumption of a particular worker node (e.g., a computer system), virtual machine, hypervisor, program execution container, etc.

[0032] Thus, embodiments of the present invention can operate to dramatically reduce the amount of data, thereby allowing each worker node to be slim and lightweight. Also, computation and response times may be significantly reduced. Therefore, the proposed concepts may be particularly applicable to large and very large cloud computing systems, where tens of thousands of services are running on a given hardware computing platform.

[0033] Furthermore, a monitoring and prediction agent associated with one worker node can not only compare selected performance metric values ​​(e.g., memory consumption) against a fixed upper bound, but can also determine memory consumption over a (short) historical time period and reflect the evolution of the worker node's memory consumption in its single binary health status value.

[0034] The subsequent comparison against upper and lower thresholds, both of which are configurable, checks not only against an upper dangerous memory consumption value, but also against a suspicious lower threshold that may indicate some malfunction in the observed service. This is because, for example, the memory indicated may be too small for the process software in question, even with its buffers and caches. Therefore, in this case too low memory consumption can also be an indicator of poor performance of individual services on worker nodes.

[0035] The use of Counting Bloom Filter (CBF) can also represent an interesting concept in the context of the proposed method for monitoring the health status of computing systems. The central concept of CBF is to separate data and individual sources (i.e., worker nodes) in the filter data array. Thus, while a monitoring service operator may be able to say that a particular one of the observed services may have a problem, the service operator may also say that a group of worker nodes may be exceeding some threshold or exhibiting a potentially anomalous computing power consumption trend. Therefore, from a security and data privacy perspective, the proposed concept can also be appreciated for not capturing any detailed data.

[0036] Furthermore, various embodiments of the present invention can extend the CBF concept by not only adding events to specific identifiers of worker nodes, but also by decrementing a counter in the filter data array if no problems are reported from the worker node. Additionally, by summing the entire contents of all filter array cells (e.g., by summing all CBF cells and dividing by the number of cache functions), an indication can be obtained about a computing node that may be failing (e.g., due to overload).

[0037] Additionally, the worker node metrics can also include cluster or region ID information in addition to the worker node's own ID, so the health status of clusters and regions can also be monitored independently of the worker node's own health status.

[0038] Thus, while embodiments of the present invention may operate to transmit only a single bit of health status information over a network, they can provide the advantage of predicting conditions for computer systems, clusters, and entire regions within a cloud computing system, potentially in unplanned and dangerous settings. This allows for workload migration from one computing system to another, from one region to another, or from one cluster to another, a task that can be performed by associated system management tools. This allows embodiments of the present invention to be conveniently integrated into a lightweight yet powerful MaaS solution for monitoring even very large cloud computing installations with 10,000 or even 100,000 worker nodes.

[0039] Further embodiments applicable to the method and related systems are described in more detail below.

[0040] According to an exemplary embodiment, the performance metric data value may relate to or be the memory usage of an individual worker node, which may represent a characteristic performance metric indicating how the worker node is performing its tasks. Given upper and lower bounds, the health status of the worker node may be characterized by such a single binary value. In particular, the monitoring and predicting agent may also have access to the most recent memory usage (e.g., in the form of a time series), allowing the agent to predict the expected evolution of memory usage in the near future. The function may be implemented by a PID (proportional, integral, derivative) filter, the results of which may also be compared with predetermined upper and lower thresholds. Thereby, memory usage that is too low may indicate a potential problem in the worker node in the same manner as memory usage that is too high. Thus, according to one advanced embodiment, determining a single binary health status value by a time-dependent function may include using a PID filter as part of the monitoring and predicting agent to determine predicted memory usage.

[0041] Furthermore, instead of memory usage, various embodiments of the present invention may utilize other parameter values, such as network bandwidth used, total storage capacity required, I / O (input / output) rate, CPU utilization, internal bus utilization, or other individual percentage values ​​or combinations thereof.

[0042] According to another embodiment of the method, the data set may be stored as an array (e.g., integer values) of a predetermined length (e.g., having a predetermined length of time), in which case a portion of the identifying information may be used as input to a hash function. The output value of the hash function may thereby be an index value for addressing a data field in the array, and the individual value of each addressed data field of the data set may be incremented (e.g., by 1) if each single binary health status value received is a logical "1." Other increment values ​​may also be possible.

[0043] As a result, according to yet another embodiment, embodiments of the present invention may operate to reduce (e.g., by 1) each individual value of an addressed data field of a data set if the received individual single binary health status value is a logical "0." Thus, the Counting Bloom Filter may be realized to its full potential.

[0044] Additionally, portions of the identity may relate to an individual hardware node, or a rack of computing nodes, or a cluster of nodes or racks, or a region. Furthermore, the complete identity (i.e., the complete network address) may also be used as input for the respective hash function.

[0045] According to one advantageous embodiment, the sum of the values ​​of the data fields in the array indicates the health status of the computing system. For this purpose, all values ​​of all area fields can be summed. A further aspect can provide functionality to reset the data area field after a predetermined time interval. Thus, normalization to "zero" can be performed periodically to adapt to the changed general conditions of the entire system, including multiple worker nodes.

[0046] Furthermore, after each initialization, each worker node can send a "1" shortly after the initialization time and a logic "0" after the computing process in the work load is up and running. Communications from the worker node can also act to reset individual fields in the data array, which can be used as indicators of successful initialization of the individual computing process or processes in the worker node.

[0047] According to an example embodiment, the method can also include storing the health status value (e.g., the CBF status) in persistent storage, thereby generating computing system load history data. The health status storage (e.g., a copy of the CBF value) can be stored periodically, or can enable fine-tuning of the health status management system if one or more predetermined thresholds for the health status value may be overrun or underrun.

[0048] According to another example embodiment, the method may also include determining (e.g., using a trend calculation agent to predict) exceptional computing system load values ​​for specific future points in time based on historical computing system load data. Such aggregate, protective values ​​of system load (e.g., which may represent the status of a larger set of worker nodes) may assist an operator or subsequent workload control system in determining prudent action to anticipate system overload.

[0049] Thus, according to yet another example embodiment, the method may also include initiating recommended corrective infrastructure or workload management actions when the exceptional computing system load value exceeds a predetermined computing system load value. Such recommended corrective infrastructure or workload management actions may include redeploying a portion of the computing system's worker nodes on alternative, less busy hardware nodes. Additionally, other corrective actions may be prescribed, which may be specific to a given use case.

[0050] According to another embodiment of the method, the worker node can be selected from the group consisting of a physical computing node, multiple physical nodes, a virtual machine, multiple virtual machines, a computing container (e.g., a Docker container), multiple computing containers, a computing process, and multiple computing processes. Additionally, other objects to be monitored can also be supported by the proposed concept.

[0051] According to an additional embodiment, the method may also include receiving a configurable upper threshold and a configurable lower threshold during initiation of the monitoring predictive agent. In some embodiments, only a worker node or individual one of the group may receive the upper and lower thresholds, thereby not requiring the values ​​to be identical for all worker nodes.

[0052] A detailed description of the drawings is provided below. All instructions in the drawings are schematic. First, a block diagram of one embodiment of a computer-implemented method of the present invention for monitoring the health status of a computing system including multiple worker nodes is provided. Thereafter, further embodiments, as well as embodiments of a computing infrastructure monitoring system for monitoring the health status of a computing system including multiple worker nodes, are described.

[0053] FIG. 1 illustrates a block diagram of a preferred embodiment of a computer-implemented method 100 for monitoring the health status of a computing system, typically set up as an element of a cloud computing center, in accordance with embodiments of the present invention. In various embodiments, the computing system includes multiple worker nodes, which can be physical or logical units, virtual machines, computing containers, hardware systems, or the like. For illustrative purposes, the method 100 illustrated in FIG. 1 can be implemented in one or more of the diagrams and systems illustrated in FIG. 2 (e.g., utilizing one or more components of architecture 200), FIG. 4 (e.g., utilizing embodiment 400 of the functionality aspect of a monitoring predictive agent), FIG. 7 (e.g., utilizing one or more components of a block diagram of an embodiment of a computing infrastructure monitoring system 700 of the present invention), and FIG. 8 (e.g., utilizing computing system 800). In an exemplary embodiment, one or more components of architecture 200, such as health management agent 214, can perform the processing steps of method 100. Alternatively, execution of method 100 is not limited to this implementation.

[0054] At step 102, method 100 includes deploying an individual monitoring predictive agent on each of a plurality of worker nodes. At step 104, method 100 includes determining (e.g., via lookup or calculation) for each of the plurality of worker nodes by the individual monitoring predictive agent a single binary health status value (e.g., "0" for "OK" and "1" for "potentially problematic") as a time-dependent function of at least one performance metric value for the individual worker node (e.g., percentage memory usage per worker node). At step 106, method 100 compares the corresponding result to predetermined configurable upper and lower thresholds.

[0055] Next, in step 108, method 100 includes receiving (typically periodically) at a health management agent, which may be remote from the worker nodes, a binary health status value from each of a plurality of worker nodes along with individual identification information (e.g., worker node, cluster, region ID, etc.). Then, in step 110, method 100 includes feeding the received identification information of each of the plurality of worker nodes to a hash function of a Counting Bloom Filter at the health management agent, thereby generating a dataset indicative of the health status of the computing system. The dataset may be organized as an array of integer values.

[0056] FIG. 2 illustrates a block diagram of one embodiment of a component architecture 200 supporting the proposed concept, according to an embodiment of the present invention. Each of the multiple worker nodes (i.e., worker node 202, worker node 204, through worker node n 206) includes an associated monitoring and prediction agent (i.e., monitoring and prediction agent 208, monitoring and prediction agent 210, and monitoring and prediction agent 212). Arrows between individual components may indicate common occasion paths between the components. First, a management agent 214, which may run remotely for worker nodes 202, 204, through 206 in a central system management system or MaaS solution, initializes the worker nodes and sends an “initialize monitoring” action to each worker node. Each initializing worker node receives a “default load” specification, which may vary from worker node to worker node. In particular, a health management agent may send upper and lower thresholds to each worker node.

[0057] Additionally, a Counting Bloom Filter (CBF) is initialized in the health management agent 214. The worker nodes then use their corresponding monitoring and prediction agents to determine what the binary health status value should be, specifically, whether it should be a logical "0" (meaning "OK") or a logical "1" (meaning "potential problem"). The determination can be made periodically, periodically, or both, or event-based. As described above (and again in the context of FIG. 1), the received binary health status values ​​of the worker nodes 202, 204, through 206 update the CBF. Additionally, periodic snapshots of the CBF data array can be stored in the health status storage 218 to generate a history of the computing system's health values.

[0058] The trend calculation agent 216 reads the CBF values ​​and snapshots to determine predicted trends in the binary health status values ​​of multiple worker nodes and derives recommended corrective actions for the computing system (i.e., worker nodes) from the trends. The health management agent 214 can then notify a system management system to implement the corrective actions. For example, the health management agent 214 can move a portion of the workload (i.e., a portion of the worker nodes) to a different hardware environment or completely move multiple worker nodes to a more powerful hardware-supporting system (e.g., in another area). Other options include making more memory available within the computing system or adding additional resources to the computing system (e.g., by software enablement of additional resources). Instead of using a system management system to implement the corrective actions, the health management agent 214 can also perform the corrective actions directly by instructing the worker nodes directly.

[0059] FIG. 3 shows a block diagram of an embodiment of a Counting Bloom Filter 300. In the illustrated example, h1 and h2 represent two different hash functions. In various embodiments, a logical "1" is received from worker nodes WN1 304, WN2 306, and WN3 308. Either complete address (i.e., identifier or identifying information) is used as input to hash functions h1 and h2. In another embodiment, a fine-tuned set of hash functions may be deployed. The index values ​​generated by the fine-tuned hash functions may be limited to the length of the data array 302.

[0060] As can be seen, the second data field from the left is addressed for the identifier of WN1 304, which leads to a logic "1" in the data field of the data array 302. The same applies to the fourth and sixth data fields of the data array 302 for the identification information of worker node WN2 306. In the seventh field of the data array 302 (the second data field from the right), the data field stores a "2". This is because the index value generated by the hash function h2 of the identification information of worker node WN1 304 and the index value generated by the hash function h2 of the identification information of worker node WN3 308 point to the same data field or index in the data array 302.

[0061] The data fields in the data array 302 can also be represented as categories for which a hash function generates an index value. Generally, the value of a data field in the data array 302 is incremented if a logical "1" is received with an individual identification (e.g., part (or all) of an individual worker node's address). Furthermore, a counter on a data field in the data array 302 is decremented if a logical "0" is received. In an exemplary implementation, the number of data fields in the data array 302 is much greater than the eight fields shown here. Additionally, the number of hash functions applied to each received identification may also be much greater.

[0062] If data array 302 is initialized with "all zeros" (or periodically reset), embodiments of the present invention may generate negative values ​​if more logic "0"s are received than logic "1"s. If it is desired to have only positive counter values ​​in the data fields of data array 302, the initialization values ​​for the individual counters should be positive starting values ​​(e.g., 512 or 1000 or similar values).

[0063] In another embodiment 350, nodes reporting status to the CBF are assigned to selected buckets in an orderly and controlled manner in the data array 352, which may allow for grouping of nodes according to categories such as expected and actual load, cluster membership, security constraints, etc. If assumptions or constraints change, the assignments can be adjusted at any time, and this can be done by an operator. Such an embodiment may allow a single CBF to be used for worker nodes with different characteristics. Alternatively, separate CBFs may be used for such different characteristics, which may allow for even finer-grained analysis of the computational load of the worker nodes. Here, worker nodes WN1 353 and WN2 354 may be associated with the same bucket / characteristic of worker nodes. The logical "1" for each data field in the data array 352 is merely symbolically indicated. WN3 356 creates its own category, while WN4 358 and WN5 360 create separate categories for other characteristics of the individual worker nodes.

[0064] Adding up all the values ​​in a dataset (e.g., 6 in data array 302 and 6 in dataset / data array 352) provides an indication of the health status of the computing system hosting the worker node. In particular, in the case of CBF dataset 352, only a selected set of data fields can be added together to analyze specific characteristics represented by the fields in the array / dataset.

[0065] 4 symbolically illustrates an embodiment 400 of the functionality aspect of the monitoring and predictive agent. A setpoint (SP) value 402 and a measured time-dependent memory consumption MC(t) 404 are used as inputs to a summer 408. The proportional component P, integral component I, and derivative component D of the PID filter determine the specific values ​​that are added by a summer 410 to output a modified predicted memory consumption value 406.

[0066] The corrected memory consumption values ​​406 are shown in a time-dependent manner in diagram 412. Values ​​between the upper threshold line 416 and the lower threshold line 414 produce a logic "0" as the binary health status value for the individual worker node, and a corrected memory consumption value 406 that is too high (above the upper threshold line 416) or too low (below the lower threshold line 414) produces a logic "1" as the binary health status value for the individual worker node.

[0067] FIG. 5 illustrates a flowchart of an exemplary implementation of an overall method embodiment 500 according to an embodiment of the present invention. For illustrative purposes, embodiment 500 illustrated in FIG. 5 may be implemented in one or more of the diagrams and systems illustrated in FIG. 2 (e.g., utilizing one or more components of architecture 200), FIG. 4 (e.g., utilizing embodiment 400 of aspects of the functionality of the monitoring predictive agent), FIG. 7 (e.g., utilizing one or more components of a block diagram of an embodiment of computing infrastructure monitoring system 700 of the present invention), and FIG. 8 (e.g., utilizing computing system 800). In an exemplary embodiment, one or more components of architecture 200, such as health management agent 214, may perform the processing steps of embodiment 500. In another exemplary embodiment, one or more components of a block diagram of an embodiment of computing infrastructure monitoring system 700 of the present invention may perform the processing steps of embodiment 500. Alternatively, execution of embodiment 500 is not limited to this implementation.

[0068] First, in step 502, embodiment 500 initializes the monitoring agent. Note that the flowchart shown here also relates to the architecture discussed above of the components involved in the proposed concept (compare FIG. 2). Next, in step 504, embodiment 500 includes sending an "Initialize Monitoring" action generated by the health management agent; in this step, embodiment 500 may also initialize the CBF (in step 506).

[0069] In a next periodic step (step 508), embodiment 500 utilizes a monitoring and predictive agent to push health status values ​​to the network (e.g., to a health management agent), and then embodiment 500 includes receiving the health status values ​​(at step 510), whereby, in step 512, embodiment 500 updates the CBF. Furthermore, the CBF status may also be periodically, event-based, stored, and / or optionally reset.

[0070] Then, in step 514, embodiment 500 includes reading the CBF status and trend snapshots and adding (in step 516) new trend snapshots. The reading is the basis for determining (in step 518) corrective action for all or a portion of the worker nodes of the computing system and further recommending (in step 520) corrective action to a separate system management system (not shown). In one embodiment, embodiment 500 also includes (in step 522) enabling the health monitoring agent to anonymously modify infrastructure technology and potentially move workloads (i.e., worker nodes) from one system to another.

[0071] FIG. 6 shows a flowchart 600 of an exemplary implementation of an embodiment of the predictive aspect of the proposed concept, according to an embodiment of the present invention. For illustrative purposes, flowchart 600 illustrated in FIG. 6 can be implemented in one or more of the diagrams and systems shown in FIG. 2 (e.g., utilizing one or more components of architecture 200), FIG. 4 (e.g., utilizing embodiment 400 of the monitoring predictive agent functionality aspect), FIG. 7 (e.g., utilizing one or more components of the block diagram of an embodiment of computing infrastructure monitoring system 700 of the present invention), and FIG. 8 (e.g., utilizing computing system 800). In an exemplary embodiment, one or more components of architecture 200, such as health management agent 214, can perform the processing steps of flowchart 600. In another exemplary embodiment, one or more components of the block diagram of an embodiment of computing infrastructure monitoring system 700 of the present invention can perform the processing steps of flowchart 600. Alternatively, execution of flowchart 600 is not limited to this implementation.

[0072] In the illustrated example, flowchart 600 begins (at step 602) with the trend calculation agent reading the most recent CBF data set and trend snapshot for a selected time frame (compare FIG. 2). The trend calculation agent then (at step 604) calculates the rate of increase or decrease in the at-risk status, i.e., the number of agents reporting a value of "1" or greater in the trend snapshot.

[0073] In step 606, flowchart 600 includes utilizing a trend calculation agent to compare the number of one or more values ​​in the most recent CBF data set to caution and danger thresholds defined for the system. If an embodiment of the present invention determines that the danger threshold has been exceeded, flowchart 600 utilizes the trend calculation agent to send an infrastructure deployment action to the health management agent in step 608. In contrast, in the caution zone, if the calculated rate increases, flowchart 600 utilizes the trend calculation agent to send a workload movement message to the health management agent (in step 610). If the caution threshold is dropped and the calculated rate decreases, flowchart 600 utilizes the trend calculation agent to send an infrastructure decommissioning message to the health management agent (in step 612).

[0074] FIG. 7 illustrates a block diagram of an embodiment of an inventive computing infrastructure monitoring system 700, in accordance with an embodiment of the present invention. The system 700 for monitoring the health status of a computing system includes a plurality of worker nodes. The system 700 includes at least one memory 704 communicatively coupled to a processor 702, the memory storing program code portions that, when loaded into and executed by the processor 702, enable the processor 702 (particularly via a receiver 706 as part of a health management system) to receive a binary health status value along with individual identification information from each of a plurality of worker nodes in a health management agent. Embodiments of the present invention are operable to determine (e.g., utilizing an individual health status value generator 708) a single binary health status value for each of a plurality of worker nodes by deploying an individual monitoring predictive agent on each of the plurality of worker nodes, the result of which is compared (e.g., by a comparison unit 710) to predetermined configurable upper and lower thresholds specific to each of the worker nodes as a time-dependent function of the individual worker node's performance metric data values. In addition, the processor 702 may also feed the received identification information of each of the plurality of worker nodes into a hash function of a Counting Bloom Filter (or alternatively, use a hash feeding module, such as the feeding unit 712), in the health management agent, thereby generating a data set indicative of the health status of the computing system (not shown).

[0075] It should be noted that the receiver 706 and the feeding unit 712 may be part of an individual health management agent system, while the health status value generator 708 and the comparison unit 710 may be part of one of the worker nodes (not shown). The different modules and units, in particular the processor 702, the memory 704, the receiver 706, the health status value generator 708, the comparison unit 710, and the feeding unit 712, are electrically interconnected for exchanging electrical signals and / or data. The interconnection can be implemented either by a system internal bus system 714, or alternatively using a network connection.

[0076] Before turning to FIG. 8, attention is directed to FIG. 9, which illustrates one embodiment of a cloud computing infrastructure in which the proposed concepts may be advantageously implemented.

[0077] Before moving to FIG. 8 , FIG. 9 illustrates a cloud computing environment 900 in which at least a portion of the inventive concepts may be deployed. A set of functional abstraction layers provided by the cloud computing environment is illustrated. It should be understood in advance that the components, layers, and functionality illustrated in FIG. 9 are intended to be merely illustrative, and embodiments of the present invention are not limited thereto. As illustrated, the following layers and corresponding functionality are provided: Hardware and software layer 902 includes hardware and software components. Examples of hardware components include a mainframe 904, a server 906, a RISC (reduced instruction set computer) architecture-based server 908, a blade server 910, a storage device 912, and a network and networking component 914. In some embodiments, software components include network application server software 916 and / or database software 918.

[0078] The virtualization layer 920 provides an abstraction layer at which the following examples of virtual entities may be provided: virtual servers 922, virtual storage 924, virtual networks 926, including virtual private networks, virtual applications and operating systems 928, and virtual clients 930. In one example, the management layer 932 may provide the functions described below. Resource provisioning 934 provides dynamic procurement of computing resources and other resources utilized to perform tasks within the cloud computing environment. Metering and billing 936 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. A user portal 938 provides consumers and system administrators with access to the cloud computing environment. Service level management 940 provides cloud computing resource allocation and management to ensure required service levels are met. Service Level Agreement (SLA) Planning and Execution 942 provides for the advance agreement of cloud computing resources in anticipation of future demands and the procurement of cloud computing resources in accordance with the SLA.

[0079] The workload layer 944 provides examples of functionality for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation 946, software development and lifecycle management 948, virtual classroom instruction delivery 950, data analytics processing 952, transaction processing 954, and symbolically, computing infrastructure monitoring systems 956 (compare 700 in FIG. 7).

[0080] Embodiments of the present invention can be implemented with virtually any type of computer, regardless of whether the platform is suitable for storing and / or executing program code. Figure 8 shows, by way of example, a computing system 800 suitable for executing program code associated with the proposed method of a health monitoring agent and / or trend calculation agent (e.g., as part of a worker node).

[0081] Computing system 800 is merely one example of a suitable computer system, and whether computer system 800 is capable of implementing and / or performing any of the functionality described herein is not intended to suggest any limitation on the scope of use or functionality of the embodiments of the invention described herein. Computer system 800 includes components operable in many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with computer system / server 800 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices. Computer system / server 800 may be described in the general context of computer system-executable instructions, such as program modules, executed by computer system 800. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer system / server 800 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0082] As shown in the figures, computer system / server 800 is depicted in the form of a general-purpose computing device. Components of computer system / server 800 may include, but are not limited to, one or more processors or processing units 802, system memory 804, and a bus 806 coupling various system components, including system memory 804, to processing unit 802. Bus 806 may represent any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. Computer system / server 800 typically includes a variety of computer system-readable media. Such media can be any available media that is accessible by computer system / server 800 and includes both volatile and nonvolatile media, removable and non-removable media.

[0083] The system memory 804 may include computer-system-readable media in the form of volatile memory, such as random access memory (RAM) 808 and / or cache memory 810. The computer system / server 800 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 812 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (typically referred to as a "hard drive" and not shown). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media. In such cases, each may be connected to the bus 806 by one or more data media interfaces. As further shown and described below, the memory 804 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of embodiments of the present invention.

[0084] A program / utility having a set (at least one) of program modules 816 can be stored in memory 804, by way of example and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, can comprise an implementation of a networking environment. The program modules 816 generally perform the functions and / or methods of embodiments of the present invention as described herein.

[0085] Computer system / server 800 may also communicate with one or more external devices 818, such as a keyboard, pointing device, display 820, one or more devices that allow a user to interact with computer system / server 800, or any device (e.g., network card, modem, etc.) that allows computer system / server 800 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur via input / output (I / O) interface 814. Furthermore, computer system / server 800 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via network adapter 822. As shown, network adapter 822 may communicate with other components of computer system / server 800 via bus 806. It should be understood that other hardware and / or software components, not shown, may be used in conjunction with computer system / server 800. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0086] Additionally, the computing infrastructure monitoring system 700 for monitoring the health status of a computing system including multiple worker nodes may be attached to the bus 806. This attachment may be understood symbolically.

[0087] The programs described herein are identified based on the application for which they are implemented in a specific embodiment of the invention. However, it should be appreciated that any particular program nomenclature herein is used merely as a matter of convenience, and that the invention should not be limited to use in any particular application identified and / or implied by such nomenclature.

[0088] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0089] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, instruction-recorded punch cards or mechanically encoded devices such as grooved and raised structures, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as ephemeral signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted over electrical wires.

[0090] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to an individual computing / processing device or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the individual computing / processing device.

[0091] Computer-readable program instructions for carrying out the operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state configuration data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer as a standalone software package, partly on the user's computer and partly on a remote computer, or all on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), can execute computer readable program instructions and individualize the electronic circuitry by utilizing state information in the computer readable program instructions to implement aspects of the present invention.

[0092] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0093] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to make a machine, such that the instructions, which execute on the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium, capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions for implementing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0094] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0095] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be performed as a single step, or may be executed concurrently, substantially concurrently, partially, or fully in a time-overlapping manner, or the blocks may sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0096] While descriptions of various embodiments of the present invention have been presented for illustrative purposes, they are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the present invention. The terminology used herein has been chosen to best explain the principles of the embodiments, practical applications, or technical improvements over techniques found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0097] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will be further understood that the terms "comprise" and / or "comprising," when used herein, specify the presence of stated features, integers, steps, operations, elements, or components or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups or combinations thereof.

[0098] In the following claims, equivalent structure, material, acts, and all means or step-plus-function element equivalents are intended to include any structure, material, or acts for performing the function as specifically claimed in combination with other claimed elements. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or to limit the invention to the form disclosed. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the invention. The embodiments have been chosen and described in order to best explain the principles and practical application of the invention, and to enable others skilled in the art to understand the invention in various embodiments with various modifications as suited to the particular uses contemplated.

Claims

1. 1. A computer-implemented method comprising: deploying, by one or more computer processors, an individual monitoring and predictive agent on each of a plurality of worker nodes of the computing system; determining, by one or more computer processors, a single binary health status value by the individual monitoring predictive agents for each of the plurality of worker nodes, wherein determining the individual single binary health status value comprises: comparing, by one or more computer processors, the time-dependent function of the performance metric data values ​​of said individual worker nodes with predetermined configurable upper and lower thresholds. said determining further comprising: receiving, by one or more computer processors, the binary health status value from each of the plurality of worker nodes along with individual identification information; generating, by one or more computer processors, a dataset indicative of a health status of the computing system by feeding the received identification information of each of the plurality of worker nodes through a hash function of a Counting Bloom Filter; 11. A computer-implemented method comprising:

2. The method of claim 1 , wherein the performance metric data values ​​correspond to memory usage of the individual worker nodes.

3. determining the single binary health status value; determining, by one or more processors, predicted memory usage using a PID (proportional-integral-derivative) filter as part of said monitoring and predicting agent; The method of claim 2 further comprising:

4. the data set is stored as an array of a predetermined length; a portion of the identification information is used as input to the hash function; the output value of the hash function is an index value for addressing a data field in the array; incrementing the respective values ​​of the addressed data fields of the data set in response to determining that the respective single binary health status value is a logical "1"; The method of claim 1.

5. The method of claim 4 , wherein the sum of the values ​​of the data fields in the array indicates the health status of the computing system.

6. generating, by one or more processors, historical computing system load data by storing in persistent storage a time series of said data sets of health status values; The method of claim 1 further comprising:

7. determining, by one or more processors, a computing system load value for the exception based on said computing system load history data for a particular future point in time; The method of claim 6 further comprising:

8. initiating, by one or more processors, recommended corrective infrastructure or workload management actions in response to determining that the exception's computing system load value has exceeded a predetermined computing system load value. The method of claim 7 further comprising:

9. 10. The method of claim 1, wherein the worker node is selected from the group consisting of a physical computing node, multiple physical nodes, a virtual machine, multiple virtual machines, a computing container, multiple computing containers, a computing process, and multiple computing processes.

10. receiving, by one or more processors, the configurable upper threshold and the configurable lower threshold during initiation of the monitoring predictive agent; The method of claim 1 further comprising:

11. A computer program product causing a computer to carry out the method according to any one of claims 1 to 10.

12. 1. A computer system comprising: one or more computer processors; one or more computer-readable storage media; program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors, the program instructions comprising: program instructions for deploying an individual monitoring and predictive agent on each of a plurality of worker nodes of a computing system; program instructions for determining, by the respective monitoring predictive agents, a single binary health status value for each of the plurality of worker nodes, the program instructions for determining the respective single binary health status value comprising: comparing the time-dependent function of the performance metric values ​​of the individual worker nodes with predetermined configurable upper and lower thresholds; the program instructions for determining the single binary health status value; program instructions for receiving the binary health status value along with individual identification information from each of the plurality of worker nodes; program instructions for generating a data set indicative of a health status of the computing system by feeding the received identification information of each of the plurality of worker nodes into a hash function of a Counting Bloom Filter; the program instructions including:

1. A computer system comprising:

13. 13. The computer system of claim 12, wherein the performance metric data values ​​correspond to memory usage of the individual worker nodes.

14. The program instructions for determining the single binary health status value include: Use a PID (Proportional-Integral-Derivative) filter as part of the monitoring and predictive agent to determine predicted memory usage 14. The computer system of claim 13, further comprising program instructions for:

15. stored on the computer-readable storage medium for execution by at least one of the one or more processors; generating computing system load history data by storing the time series of said data set of health status values ​​in persistent storage; 13. The computer system of claim 12, further comprising program instructions for:

16. stored on the computer-readable storage medium for execution by at least one of the one or more processors; determining a computing system load value for the exception based on historical computing system load data for a particular future point in time; 16. The computer system of claim 15, further comprising program instructions for:

17. stored on the computer-readable storage medium for execution by at least one of the one or more processors; Initiating recommended corrective infrastructure or workload management actions in response to determining that the exception's computing system load value exceeds a predetermined computing system load value.

17. The computer system of claim 16, further comprising program instructions for:

18. 13. The computer system of claim 12, wherein the worker node is selected from the group consisting of a physical computing node, multiple physical nodes, a virtual machine, multiple virtual machines, a computing container, multiple computing containers, a computing process, and multiple computing processes.

Images