RELATED APPLICATIONS

This application claims the benefit of and priority to U.S. patent application Ser. No. 16/16,149 entitled “ENHANCED IDENTIFICATION OF COMPUTER PERFORMANCE ANOMALIES BASED ON COMPUTER PERFORMANCE LOGS,” filed on Aug. 29, 2018, which is hereby incorporated by reference in its entirety for all purposes.

TECHNICAL BACKGROUND

Computers host web sites, sales applications, media content, financial databases, customer records, and the like. A large cloud computing network may feature a large number of data centers around the globe that each have numerous computers. The data centers serve hospitals, schools, media networks, government agencies, web businesses, and the like. The management of these large cloud and complex computing networks is a significant challenge. Computer analysts often study computer performance logs to manage cloud computing networks. The computers that comprise the cloud generate the computer performance logs as a part of their normal operation. The computer performance logs are human-readable statements that indicate the current status of the circuitry, operating systems, databases, and applications in the cloud.

A typical computer performance log might be “HOST X23 STARTS APP 341267 2108:06:03:14:33:18.” In large cloud computing networks, a massive number of computers may each produce performance logs every second or so. This raw amount of computer performance logs is a challenge to digest. In addition, the diversity of computer performance logs is also a challenge because the logs are not uniform. The syntax of computer performance logs may not only differ between individual computers but may change over time as well.

Data network operators use computer performance logs to service the end-users of the cloud computing networks. For example, a computer technician may receive an alarm that a hospital is experiencing excessive database latency. The computer technician may study the relevant computer performance logs for the computers that serve the hospital to solve the latency problem. The computer technician may then establish an automated computer response to specific computer performance logs by subsequently detecting the same log text and launching a pre-selected computer script. This manual approach to processing computer performance logs is not scalable.

Computer technicians cannot manually handle the massive amount of computer performance logs, so automated computer tools have been developed. These log analytic tools require structured log lines that are pre-associated with known anomalies, but this not proven to be an effective situation in many global computer networks. Many log analytic tools operate off-line on archived log lines to detect performance anomalies, but the off-line log analytic tools are too slow to mitigate computer performance anomalies in real-time. Current log analytic tools are not optimized to handle the massive quantity of diverse computer performance logs that are produced by today's global computer networks. Current log analytic tools are not configured to efficiently detect and mitigate these complex computer performance anomalies in real time.

TECHNICAL OVERVIEW

In an exemplary embodiment, computer circuitry determines term characterization values for terms in computer performance logs and generates vectors that indicate the term characterization values. The computer circuitry determines vector similarity scores for these vectors. The computer circuitry aggregates the computer performance logs into aggregated logs based on the vector similarity scores. The computer circuitry selects rare logs from these aggregated logs and obtains computer performance anomaly labels for the rare logs. The computer circuitry matches new computer performance logs with the rare logs to detect the labeled computer performance anomalies.

