# Discovery of Cloud Applications from Logs
## 3 Materials and Methods
### Experimental Set up for ADLog  
To evaluate the ET-based grouping method, it is applied to a set of applications with ground truths coming from SD in Aria Ops (which is approved and labeled by developers) and from Engineering Services managing various internally deployed applications. Figure 1: ADLog system architecture for identifying M similarity groups of application sources. The ground truth applications monitored in Aria for Logs are listed in Table 1. The kinds of applications and status (whether it is a standalone instance although of the same kind, like ESX16 in the table) of entities within those applications are also indicated. The list includes vR Ops and vR LI apps with relevant services discovered by SD. This adapter or management pack-based discovery mechanism executes commands in the guest operating system (OS) of the corresponding VMs and finds out which services are running and which ones communicate through ports. The discovered applications can be both predefined and custom. In particular, the vR Ops application instance (of Table 1) consists of two VM nodes. There are multiple services in this app, for instance, \"vROPs Analytics\" which performs data manipulation and learning tasks such as typical ranges of time series metrics for anomaly detection. Those services are hosted by different VMs; however, they are part of the same \"vRealize Operations\" application. Another application discovered by SD is \"vRLI\" (Table 1). There are three nodes in the application and each of them are connected to the other node through services. Both applications definitely exist in the monitored environment. The rest of the applications in Table 1 are confirmed by the engineering teams dealing with internally deployed apps under the monitoring of Aria Ops for Logs. For instance, F5 load balancer has two distinct instances. Analogously, the host esx16 is not a part of the same service application consisting of the rest of the nine hosts, but a different service running with an NSX. An AD method has to learn and distinguish the applications in Table 1, subject to their kind and deployment instances ideally. This list of applications of various natures serves as an exemplary set of log sources against which we demonstrate the viability of our methods in terms of their high-accuracy classification. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Log Sources** & **Application Kind** & **Deployment** \\ \hline
10.27.74.245 & F5 Load Balancer v13 & standalone \\ \hline
10.27.74.233 & F5 Load Balancer v12 & standalone \\ \hline
10.27.82.46 & vRLI & \\ \hline
10.27.82.45 & vRLI & part of one \\ \hline
10.27.82.43 & vRLI & \\ \hline evn1-hs1-a0716.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0719.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0717.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0720.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0722.eng.vmware.com & ESXi (+vSAN) & under the same vSphere \\ \hline evn1-hs1-a0723.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0724.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0721.eng.vmware.com & ESXi (+vSAN) & \\ \hline evn1-hs1-a0718.eng.vmware.com & ESXi (+vSAN) & \\ \hline sc2-05-r19 esx16.oc.vmware.com & ESXi (+NSX) & standalone \\ \hline
10.27.82.51 & vROPs & part of one \\ \hline
10.27.82.52 & vROPs & \\ \hline
10.27.74.219 & Microsoft Internet & \\  & Information Server & standalone \\ \hline
10.27.74.218 & PaloAltoNetworks & standalone \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Ground truth app kinds and their structure. An examplary ET distribution charting over a time axis is depicted for the load balancer application F5 in Figure 2. For each time interval, the relative presence of ETs can be converted to relevant probability distributions (as discribed in the prior art literature, as well as in the next subsection).