System and method for determining relevant computer performance events

• US 10,291,493 B1
• Filed: 12/05/2014
• Issued: 05/14/2019
• Est. Priority Date: 12/05/2014
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Quest Software, Inc.
• Inventors: Rustad, Joseph, Wang, Xiangrui, Jackson, Philip
• Primary Examiner(s): Rutkowski, Jeffrey M
• Assistant Examiner(s): Wood, Jonathan
• Application Number:
  US14/562,474
• Time in Patent Office: 1,621 Days
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic

Abstract

In one embodiment, a method includes identifying at least one transaction-path node as a problem node based, at least in part, on an analysis of end-to-end response times for a group of transactions. The method further includes determining one or more event types for the at least one transaction-path node. Also, the method includes, for each of the one or more event types, inferring a first event-relevance weight from an abstract model. The method also includes, for each of the one or more event types, inferring a second event-relevance weight from a concrete model. Furthermore, the method includes, for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight. Additionally, the method includes identifying most-relevant events among a set of active events based, at least in part, on the determined event relevance.

Claims

1. A method comprising, by a computer system:

monitoring, in real-time, end-user transactions that pass through an end-to-end transaction path comprising a plurality of transaction-path nodes;

responsive to the monitoring, identifying at least one transaction-path node of the plurality of transaction-path nodes as a problem node based, at least in part, on an analysis of end-to-end response times for a group of the monitored end-user transactions;

determining one or more event types that are related to the at least one transaction-path node based, at least in part, on the one or more event types being at least indirectly connected to the at least one transaction-path node in at least one of an abstract model and a concrete model;

wherein the abstract model comprises a first probabilistic graphical model that represents a set of monitored-resource types, a plurality of event types, and a probabilistic relevance of the monitored-resource types to the plurality of event types, the set of monitored-resource types comprising a monitored-resource type of the at least one transaction-path node, the plurality of event types comprising the one or more event types;

wherein the concrete model comprises a second probabilistic graphical model that represents a real-time topology of monitored resources, the plurality of event types, and a probabilistic relevance of the monitored resources to the plurality of event types such that the monitored resources are instances of the monitored-resource types, the monitored resources comprising the at least one transaction path node;

for each of the one or more event types, inferring a first event-relevance weight from the abstract model;

for each of the one or more event types, inferring a second event-relevance weight from the concrete model;

for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight;

identifying a set of currently-firing events that correspond to one or more of the one or more event types;

identifying most-relevant events among the set of currently-firing events based, at least in part, on the determined event relevance; and

publishing the identified most-relevant events to a user to facilitate troubleshooting of the problem node.

2. The method of claim 1, wherein the identifying of the at least one transaction-path node comprises calculating a response-time differential between an execution time by the at least one transaction-path node in deemed unacceptable transactions and an execution time by the at least one transaction-path node in deemed acceptable transactions.

3. The method of claim 2, comprising:

determining a base relevance value for the at least one transaction-path node;

and wherein the determining of the event relevance is based, at least in part, the base relevance value.

4. The method of claim 3, wherein the base relevance value comprises a normalization of the response-time differential.

5. The method of claim 1, comprising selecting the group of transactions, the group having a common end-to-end transaction path comprising a plurality of transaction-path nodes, the plurality of transaction-path nodes comprising the at least one transaction-path node.

6. The method of claim 1, comprising transmitting a report to another system for analysis.

7. The method of claim 1, wherein the abstract model and the concrete model each comprise a Bayesian network.

8. The method of claim 1, comprising deferring evaluation of one or more rules associated with at least one event until the at least one event is determined sufficiently relevant as a result of the determining of the event relevance.

9. The method of claim 1, comprising training the abstract model and the concrete model using a result of the determining of the event relevance.

10. An information handling system comprising:

a processor and memory, wherein the processor and memory in combination are operable to implement a method comprising;

monitoring, in real-time, end-user transactions that pass through an end-to-end transaction path comprising a plurality of transaction-path nodes;

responsive to the monitoring, identifying at least one transaction-path node of the plurality of transaction-path nodes as a problem node based, at least in part, on an analysis of end-to-end response times for a group of the monitored end-user transactions;

determining one or more event types that are related to the at least one transaction-path node based, at least in part, on the one or more event types being at least indirectly connected to the at least one transaction-path node in at least one of an abstract model and a concrete model;

wherein the abstract model comprises a first probabilistic graphical model that represents a set of monitored-resource types, a plurality of event types, and a probabilistic relevance of the monitored-resource types to the plurality of event types, the set of monitored-resource types comprising a monitored-resource type of the at least one transaction-path node, the plurality of event types comprising the one or more event types;

wherein the concrete model comprises a second probabilistic graphical model that represents a real-time topology of monitored resources, a plurality of event types, and a probabilistic relevance of the monitored resources to the plurality of event types such that the monitored resources are instances of the monitored-resource types, the monitored resources comprising the at least one transaction path node;

for each of the one or more event types, inferring a first event-relevance weight from the abstract model;

for each of the one or more event types, inferring a second event-relevance weight from the concrete model;

for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight;

identifying a set of currently-firing events that correspond to one or more of the one or more event types;

identifying most-relevant events among the set of currently-firing events based, at least in part, on the determined event relevance; and

publishing the identified most-relevant events to a user to facilitate troubleshooting of the problem node.

11. The information handling system of claim 10, wherein the identifying of the at least one transaction-path node comprises calculating a response-time differential between an execution time by the at least one transaction-path node in deemed unacceptable transactions and an execution time by the at least one transaction-path node in deemed acceptable transactions.

12. The information handling system of claim 11, the method comprising:

determining a base relevance value for the at least one transaction-path node;

and wherein the determining of the event relevance is based, at least in part, the base relevance value.

13. The information handling system of claim 12, wherein the base relevance value comprises a normalization of the response-time differential.

14. The information handling system of claim 10, the method comprising selecting the group of transactions, the group having a common end-to-end transaction path comprising a plurality of transaction-path nodes, the plurality of transaction-path nodes comprising the at least one transaction-path node.

15. The information handling system of claim 10, the method comprising transmitting a report to another system for analysis.

16. The information handling system of claim 10, wherein the abstract model and the concrete model each comprise a Bayesian network.

17. The information handling system of claim 10, the method comprising deferring evaluation of one or more rules associated with at least one event until the at least one event is determined sufficiently relevant as a result of the determining of the event relevance.

18. The information handling system of claim 10, the method comprising training the abstract model and the concrete model using a result of the determining of the event relevance.

19. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed by a processor to implement a method comprising:

monitoring, in real-time, end-user transactions that pass through an end-to-end transaction path comprising a plurality of transaction-path nodes;

responsive to the monitoring, identifying at least one transaction-path node of the plurality of transaction-path nodes as a problem node based, at least in part, on an analysis of end-to-end response times for a group of the monitored end-user transactions;

determining one or more event types that are related to the at least one transaction-path node based, at least in part, on the one or more event types being at least indirectly connected to the at least one transaction-path node in at least one of an abstract model and a concrete model;

wherein the abstract model comprises a first probabilistic graphical model that represents a set of monitored-resource types, a plurality of event types, and a probabilistic relevance of the monitored-resource types to the plurality of event types, the set of monitored-resource types comprising a monitored-resource type of the at least one transaction-path node, the plurality of event types comprising the one or more event types;

wherein the concrete model comprises a second probabilistic graphical model that represents a real-time topology of monitored resources, a plurality of event types, and a probabilistic relevance of the monitored resources to the plurality of event types such that the monitored resources are instances of the monitored-resource types, the monitored resources comprising the at least one transaction path node;

for each of the one or more event types, inferring a first event-relevance weight from the abstract model;

for each of the one or more event types, inferring a second event-relevance weight from the concrete model;

for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight;

identifying a set of currently-firing events that correspond to one or more of the one or more event types;

identifying most-relevant events among the set of currently-firing events based, at least in part, on the determined event relevance; and

publishing the identified most-relevant events to a user to facilitate troubleshooting of the problem node.

20. The computer-program product of claim 19, wherein the identifying of the at least one transaction-path node comprises calculating a response-time differential between an execution time by the at least one transaction-path node in deemed unacceptable transactions and an execution time by the at least one transaction-path node in deemed acceptable transactions.