It is hard to operate and debug systems like OpenStack that integrate many independently developed modules with multiple levels of abstractions. A major challenge is to navigate through the complex dependencies and relationships of the states in different modules or subsystems, to ensure the correctness and consistency of these states. We present a system that captures the runtime states and events from the entire OpenStack-Ceph stack, and automatically organizes these data into a graph that we call system operation state graph (SOSG).With SOSG we can use intuitive graph traversal techniques to solve problems like reasoning about the state of a virtual machine. Also, using graph-based anomaly detection, we can automatically discover hidden problems in OpenStack. We have a scalable implementation of SOSG, and evaluate the approach on a 125-node production OpenStack cluster, finding a number of interesting problems.
Anomaly detection has been widely used in system problem detection @cite_11 . @cite_18 takes advantage of Spark to perform large scale anomaly detection, and use it to detect VM performance problems. @cite_19 uses anomaly detection to find faults in a multi-tier web system with redundancy. These projects use a small number of homogeneous data source, while we mainly focus on analyzing states cross different system components.
@cite_19 @cite_18 @cite_11
2044019460 1964274671 2560021099 2187472121
Anomaly detection refers to the identification of patterns in a dataset that do not conform to expected patterns. Depending on the domain, the non-conformant patterns are assigned various tags, e.g. anomalies, outliers, exceptions, malwares and so forth. Online anomaly detection aims to detect anomalies in data flowing in a streaming fashion. Such stream data is commonplace in today's cloud data centers that house a large array of virtual machines(VM) producing vast amounts of performance data in real-time. Sophisticated detection mechanism will likely entail collation of data from heterogeneous sources with diversified data format and semantics. Therefore, detection of performance anomaly in this context requires a distributed framework with high throughput and low latency. Apache Spark is one such framework that represents the bleeding-edge amongst its contemporaries. In this paper, we have taken up the challenge of anomaly detection in VMware based cloud data centers. We have employed a Chi-square based statistical anomaly detection technique in Spark. We have demonstrated how to take advantage of the high processing power of Spark to perform anomaly detection on heterogeneous data using statistical techniques. Our approach is optimally designed to cope with the heterogeneity of input data streams and the experiments we conducted testify to its efficacy in online anomaly detection. We report on an automated runtime anomaly detection method at the application layer of multi-node computer systems. Although several network management systems are available in the market, none of them have sufficient capabilities to detect faults in multi-tier Web-based systems with redundancy. We model a Web-based system as a weighted graph, where each node represents a "service" and each edge represents a dependency between services. Since the edge weights vary greatly over time, the problem we address is that of anomaly detection from a time sequence of graphs.In our method, we first extract a feature vector from the adjacency matrix that represents the activities of all of the services. The heart of our method is to use the principal eigenvector of the eigenclusters of the graph. Then we derive a probability distribution for an anomaly measure defined for a time-series of directional data derived from the graph sequence. Given a critical probability, the threshold value is adaptively updated using a novel online algorithm.We demonstrate that a fault in a Web application can be automatically detected and the faulty services are identified without using detailed knowledge of the behavior of the system. Anomaly detection plays an important role in managementof modern large-scale distributed systems. Logs, whichrecord system runtime information, are widely used for anomalydetection. Traditionally, developers (or operators) often inspectthe logs manually with keyword search and rule matching. Theincreasing scale and complexity of modern systems, however, make the volume of logs explode, which renders the infeasibilityof manual inspection. To reduce manual effort, many anomalydetection methods based on automated log analysis are proposed. However, developers may still have no idea which anomalydetection methods they should adopt, because there is a lackof a review and comparison among these anomaly detectionmethods. Moreover, even if developers decide to employ ananomaly detection method, re-implementation requires a nontrivialeffort. To address these problems, we provide a detailedreview and evaluation of six state-of-the-art log-based anomalydetection methods, including three supervised methods and threeunsupervised methods, and also release an open-source toolkitallowing ease of reuse. These methods have been evaluated ontwo publicly-available production log datasets, with a total of15,923,592 log messages and 365,298 anomaly instances. Webelieve that our work, with the evaluation results as well asthe corresponding findings, can provide guidelines for adoptionof these methods and provide references for future development. This thesis analyses the adequacy and the performance of the Apache Spark Streaming engine in the context of anomaly detection in water distribution networks (WDN). It builds on an already proposed scenario in which sensors are extensively deployed in a WDN allowing for distributed, near-real-time anomaly detection. For this purpose, it uses several variations of LISA statistics and according statistical tests. In order to show that Spark Streaming is applicable to such a setting, algorithms computing these statistics in Spark Streaming were developed. Subsequently, the resulting prototype was tested in a simulated WDN setting. Finally, the performance of the different algorithms as well as the impact of several network characteristics were measured. The results show that the calculation of LISA statistics can be achieved with reasonable performance by using Spark Streaming. Furthermore, they reveal certain characteristics and limitations of Spark Streaming.