Identifying virtual machines that perform inconsistent with a profile

摘要

Methods, systems and computer program products for identifying virtual machines that perform inconsistent with a profile are provided. Methods may include collecting initial virtual machine data corresponding to multiple virtual machines. Multiple virtual machine profiles are generated and each of the virtual machine profiles is associated with one of multiple virtual machine types. Ones of the virtual machines are associated with one of the virtual machine profiles based on the virtual machine data. Additional virtual machine data corresponding to ones of the virtual machines is collected. The additional virtual machine data is analyzed to detect a deviation of one of the virtual machines.

主权项

1. A method of operating a computer system, the method comprising:
analyzing static data and dynamic data corresponding to a virtual machine of a plurality of virtual machines, wherein the static data is attribute data corresponding to the virtual machine and dynamic data is usage data collected at a given temporal instant corresponding to the virtual machine; assigning an initial virtual machine profile type from a plurality of virtual machine profile types based on the static and dynamic data corresponding to the virtual machine, wherein the plurality of virtual machine profile types include at least two of: a profile type directed to the types of software running on the virtual machine, a profile type directed to the type of physical attributes associated with the virtual machine, and a profile type directed to the current architectural usage of the virtual machine by the user, and wherein each virtual machine profile type was generated by a unique previous analysis of data associated with the plurality of virtual machines; determining a subset of the plurality of virtual machines that are of the same profile type as the initial virtual machine profile type; generating an updated virtual machine profile type based on additional data corresponding to the virtual machine and based on aggregated additional data corresponding to the subset of the plurality of virtual machines that were determined to have the same profile type as the initial virtual machine profile type; detecting a deviation of the virtual machine relative to the initial virtual machine profile by detecting that the initial virtual machine profile type corresponds to a first virtual machine profile type and that the updated virtual machine profile type corresponds to a second virtual machine profile type that is different from the first virtual machine profile type; determining whether the deviation is expected or not based on detecting that other virtual machines in the subset are not associated with a virtual machine profile that corresponds to the second virtual machine profile type; and if it is determined that there is a deviation and the deviation is not expected, performing an automatic remediation operation that comprises transmitting a message corresponding to the deviation, storing data corresponding to the deviation, and changing an operating parameter of the virtual machine.