Correlating log data with performance measurements having a specified relationship to a threshold value
First Claim
Patent Images
1. A computer-implemented method for improving data analysis of performance of components in an information technology environment, the method comprising:
- acquiring, by a computer system, performance measurements for a performance metric, each of the performance measurements indicating an extent of performance of at least one hardware or software component of an information technology (IT) environment at a particular time for the performance metric;
acquiring, by the computer system, log data representing activity of the at least one hardware or software component of the IT environment;
comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value;
correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation criterion; and
causing display, via a graphical user interface, of an indication of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data wherein the indications of the correlated portion of log data and the at least one of the performance measurements facilitate determining unsatisfactory performance of a hardware or software component of the information technology (IT) environment and implementing a modification to the IT environment to address the unsatisfactory performance of the hardware or software component.
1 Assignment
0 Petitions
Accused Products
Abstract
The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.
-
Citations
30 Claims
-
1. A computer-implemented method for improving data analysis of performance of components in an information technology environment, the method comprising:
-
acquiring, by a computer system, performance measurements for a performance metric, each of the performance measurements indicating an extent of performance of at least one hardware or software component of an information technology (IT) environment at a particular time for the performance metric; acquiring, by the computer system, log data representing activity of the at least one hardware or software component of the IT environment; comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value; correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation criterion; and causing display, via a graphical user interface, of an indication of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data wherein the indications of the correlated portion of log data and the at least one of the performance measurements facilitate determining unsatisfactory performance of a hardware or software component of the information technology (IT) environment and implementing a modification to the IT environment to address the unsatisfactory performance of the hardware or software component. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
-
-
29. A non-transitory machine-readable storage medium for use in a processing system of a data intake and query system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:
-
acquiring, by a computer system, performance measurements a performance metric, each of the performance measurements indicating an extent of performance of at least one hardware or software component of an information technology (IT) environment at a particular time for the performance metric; acquiring, by the computer system, log data representing activity of the at least one hardware or software component of the IT environment; comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value; correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation criterion; and causing display, via a graphical user interface, of an indication of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data wherein the indications of the correlated portion of log data and the at least one of the performance measurements facilitate determining unsatisfactory performance of a hardware or software component of the information technology (IT) environment and implementing a modification to the IT environment to address the unsatisfactory performance of the hardware or software component.
-
-
30. A system comprising:
-
a communication device through which to communicate on a computer network; and at least one processor operatively coupled to the communication device and configured to perform operations including acquiring, by a computer system, performance measurements for a performance metric, each of the performance measurements indicating an extent of performance of at least one hardware or software component of an information technology (IT) environment at a particular time for the performance metric; acquiring, by the computer system, log data representing activity of the at least one hardware or software component of the IT environment; comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value; correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation criterion; and causing display, via a graphical user interface, of an indication of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data wherein the indications of the correlated portion of log data and the at least one of the performance measurements facilitate determining unsatisfactory performance of a hardware or software component of the information technology (IT) environment and implementing a modification to the IT environment to address the unsatisfactory performance of the hardware or software component.
-
Specification