Method and apparatus for monitoring and recording computer system performance parameters

• US 20040078723A1
• Filed: 10/17/2002
• Published: 04/22/2004
• Est. Priority Date: 10/17/2002
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Gross, Kenny C., Votta, Larry G. Jr.
• Granted Patent: US 7,020,802 B2
• Time in Patent Office: Days
• US Class Current: 714/47
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

One embodiment of the present invention provides a system that systematically monitors and records performance parameters for a computer system. During operation, the system periodically measures values for a set of performance parameters associated with the computer system while the computer system continues operating. The system then records the values on a data storage device, wherein the recording process keeps track of temporal relationships between events in different performance parameters. The system subsequently allows the recorded values for the set of performance parameters to be analyzed.

Claims

1. A method for systematically monitoring and recording performance parameters for a computer system, comprising:

periodically measuring values for a set of performance parameters associated with the computer system while the computer system continues operating; and

recording the values on a data storage device;

wherein the recording process keeps track of temporal relationships between events in different performance parameters; and

subsequently allowing the recorded values for the set of performance parameters to be analyzed.

2. The method of claim 1, wherein recording the values involves storing the values in a circular file, wherein if the circular file is full, new incoming values overwrite the oldest existing values in the circular file.

3. The method of claim 2, wherein the circular file has a dual-stage structure, including:

a first stage that maintains fine-grain, high-sampling rate data for the set of performance parameters over a preceding first time window; and

a second stage that stores ensemble averages of data from the first stage over a preceding second time window, wherein the second time window is larger that the first time window.

4. The method of claim 2, wherein subsequently allowing the recorded values for the set of performance parameters to be analyzed involves:

detecting an anomaly in one or more of the performance parameters; and

in response to the anomaly,

freezing a state of the circular file in persistent storage while the computer systems continues operating, and

transmitting the frozen state of the circular file to an analyst.

5. The method of claim 4, wherein transmitting the frozen state of the circular file to the analyst involves transmitting the frozen state to a remote monitoring center.

6. The method of claim 4, wherein detecting the anomaly can involve using:

a threshold limit test on one or more performance parameters;

an automated data mining and pattern recognition agent;

a soft error rate discriminator (SERD);

a sequential probability ratio test (SPRT);

a multivariate state estimation technique (MSET);

a signature analysis mechanism for intrusion detection; and

a neural network.

7. The method of claim 1,

wherein the computer system is comprised of a plurality of field replaceable units (FRUs);

and

wherein recording the values involves recording events for each FRU in local storage associated with each FRU.

8. The method of claim 1, wherein the set of performance parameters can include:

internal performance parameters maintained by software within the computer system;

physical performance parameters measured through sensors located in proximity to the computer system; and

canary performance parameters associated with synthetic user transactions periodically generated for performance measuring purposes.

9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for systematically monitoring and recording performance parameters for a computer system, the method comprising:

periodically measuring values for a set of performance parameters associated with the computer system while the computer system continues operating; and

recording the values on a data storage device;

wherein the recording process keeps track of temporal relationships between events in different performance parameters; and

subsequently allowing the recorded values for the set of performance parameters to be analyzed.

10. The computer-readable storage medium of claim 9, wherein recording the values involves storing the values in a circular file, wherein if the circular file is full, new incoming values overwrite the oldest existing values in the circular file.

11. The computer-readable storage medium of claim 10, wherein the circular file has a dual-stage structure, including:

a first stage that maintains fine-grain, high-sampling rate data for the set of performance parameters over a preceding first time window; and

a second stage that stores ensemble averages of data from the first stage over a preceding second time window, wherein the second time window is larger that the first time window.

12. The computer-readable storage medium of claim 10, wherein subsequently allowing the recorded values for the set of performance parameters to be analyzed involves:

detecting an anomaly in one or more of the performance parameters; and

in response to the anomaly,

freezing a state of the circular file in persistent storage while the computer system continues operating, and

transmitting the frozen state of the circular file to an analyst.

13. The computer-readable storage medium of claim 12, wherein transmitting the frozen state of the circular file to the analyst involves transmitting the frozen state to a remote monitoring center.

14. The computer-readable storage medium of claim 12, wherein detecting the anomaly can involve using:

a threshold limit test on one or more performance parameters;

an automated data mining and pattern recognition agent;

a soft error rate discriminator (SERD);

a sequential probability ratio test (SPRT);

a multivariate state estimation technique (MSET);

a signature analysis mechanism for intrusion detection; and

a neural network.

15. The computer-readable storage medium of claim 9,

wherein the computer system is comprised of a plurality of field replaceable units (FRUs);

and

wherein recording the values involves recording events for each FRU in local storage associated with each FRU.

16. The computer-readable storage medium of claim 9, wherein the set of performance parameters can include:

internal performance parameters maintained by software within the computer system;

physical performance parameters measured through sensors located in proximity to the computer system; and

canary performance parameters associated with synthetic user transactions periodically generated for performance measuring purposes.

17. An apparatus that systematically monitors and records performance parameters for a computer system, comprising:

a measurement mechanism configured to periodically measure values for a set of performance parameters associated with the computer system while the computer system continues operating; and

a recording mechanism configured to record the values on a data storage device;

wherein the recording mechanism keeps track of temporal relationships between events in different performance parameters; and

an analysis mechanism configured to allow the recorded values for the set of performance parameters to be analyzed.

18. The apparatus of claim 17, wherein the recording mechanism is configured to store the values in a circular file, wherein if the circular file is full, new incoming values overwrite the oldest existing values in the circular file.

19. The apparatus of claim 18, wherein the circular file has a dual-stage structure, including:

a first stage that maintains fine-grain, high-sampling rate data for the set of performance parameters over a preceding first time window; and

a second stage that stores ensemble averages of data from the first stage over a preceding second time window, wherein the second time window is larger that the first time window.

20. The apparatus of claim 18, wherein the analysis mechanism is configured to:

detect an anomaly in one or more of the performance parameters; and

in response to the anomaly, to

freeze a state of the circular file in persistent storage while the computer system continues operating, and to

transmit the frozen state of the circular file to an analyst.

21. The apparatus of claim 20, wherein the analyst is located at a remote monitoring center.

22. The apparatus of claim 20, wherein the measuring mechanism can be configured to use:

a threshold limit test on one or more performance parameters;

an automated data mining and pattern recognition agent;

a soft error rate discriminator (SERD);

a sequential probability ratio test (SPRT);

a multivariate state estimation technique (MSET);

a signature analysis mechanism for intrusion detection; and

a neural network.

23. The apparatus of claim 17,

wherein the computer system is comprised of a plurality of field replaceable units (FRUs);

and

wherein the recording mechanism is configured to record events for each FRU in local storage associated with each FRU.

24. The apparatus of claim 17, wherein the set of performance parameters can include:

internal performance parameters maintained by software within the computer system;

physical performance parameters measured through sensors located in proximity to the computer system; and

canary performance parameters associated with synthetic user transactions periodically generated for performance measuring purposes.