Computer operation analysis

• US 20050166081A1
• Filed: 12/22/2004
• Published: 07/28/2005
• Est. Priority Date: 12/26/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ide, Tsuyoshi, Kashima, Hisashi, Etoh, Hiroaki, Hirade, Ryo
• Granted Patent: US 7,493,361 B2
• Time in Patent Office: Days
• US Class Current: 714/4
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Provides an analysis system for analyzing dependencies among server programs in a computer system, comprising: a transaction detection unit for detecting transactions that is processing of a service which each of the plurality of server programs performs by being called from any other server program; a child transaction candidate detection unit for detecting candidates for a child transaction of each detected transaction, the child transaction being called in the transaction concerned; and a calling frequency calculation unit for outputting service calling frequencies obtained by estimating a frequency at which each server program allows each of the other server programs to perform a service by calling the other program, the estimation being made based on the service detected in association with each transaction and on a service detected in association with the candidate for the child transaction of the transaction.

Claims

1. An analysis system for analyzing dependencies among a plurality of server programs, said server programs providing services to one another operating in a computer system, said analysis system comprising:

a transaction detection unit for detecting transactions in association with a service which each of the plurality of server programs performs by being called from any other server program, the transaction being processing of the service;

a child transaction candidate detection unit for detecting candidates for a child transaction of each transaction detected by the transaction detection unit, the child transaction being another transaction called in the transaction; and

a calling frequency calculation unit for calculating and outputting service calling frequencies obtained by estimating frequencies at which each server program allows each of the other server programs to perform a service by calling the other program, the estimation being made based on the service detected in association with each transaction and on a service detected in association with the candidate for the child transaction of the transaction.

2. The analysis system according to claim 1,

wherein each of the plurality of server programs operates in any of a plurality of server devices owned by the computer system,

the transaction detection unit further detects, in association with each transaction, identification information of server devices that are a call origination and call destination of the transaction, and

for each transaction detected by the transaction detection unit, the child transaction candidate detection unit detects, as the candidate for the child transaction, each of the other transactions, which defines a server device that is a call destination of the transaction as a call origination.

3. The analysis system according to claim 2,

wherein, when each server program performs the transaction by being called from any server program outside of the computer system, the transaction detection unit detects the same identification information as identification information of a call origination of the transaction.

4. The analysis system according to claim 2,

wherein the plurality of server devices are interconnected by a network, and

the transaction detection unit detects, from the network, a communication packet for use in calling the transaction in the computer system, detects an source IP address and destination IP. address of the detected communication packet as the identification information of the server devices that are the call origination and call destination of the transaction, and detects a service identified by a destination port number of the communication packet as a service performed by the transaction.

5. The analysis system according to claim 1,

wherein the transaction detection unit further detects a start time and a finish time of each transaction in association therewith, and

for each transaction detected by the transaction detection unit, the child transaction candidate detection unit detects, as the candidate for the child transaction, another transaction starting after the start time of the transaction and finishing before the finish time thereof.

6. The analysis system according to claim 5,

wherein, when the transaction detection unit detects a first transaction, a second transaction starting after the first transaction and finishing before the first transaction, and a third transaction starting after both of the first and second transactions and finishing before both of the first and second transactions, the child transaction candidate detection unit detects the third transaction as a candidate for a child transaction of the second transaction, and excludes the third transaction from a candidate for a child transaction of the first transaction.

7. The analysis system according to claim 1,

wherein, for each service program, a service calling probability value that is a estimated value for a probability at which the service program is called from each of the other service programs is predetermined,

the analysis system further comprises:

a transaction calling probability value calculation unit for calculating, based on the service calling probability value, a transaction calling probability value that is a probability at which each transaction is called from each of the plurality of server programs; and

a service calling probability value calculation unit for calculating, based on the transaction calling probability value for each transaction performing the same service, another service calling probability value, and

the calling frequency calculation unit repeats processing of further allowing the transaction calling probability value calculation unit to calculate the transaction calling probability value based on the service calling probability value calculated by the service calling probability value calculation unit, and when a difference between a service calling probability value calculated before one step of the iteration and a service calling probability value calculated after one step of the iteration is converged within a predetermined range, calculates and outputs the service calling frequency based on the service calling probability values in which the difference is converged.

8. The analysis system according to claim 7,

wherein, based on the transaction calling probability value for each transaction, the calling frequency calculation unit further calculates a calling frequency of each transaction when, as a result of that a predetermined transaction is called, the other transactions are called sequentially in a chained manner, and based on the calculated calling frequency of each transaction, calculates and outputs a service calling frequency when, as a result of that a predetermined starting point service is called, the other services are called sequentially in a chained manner.

9. The analysis system according to claim 7,

wherein, based on the calculated service calling frequency, the calling frequency calculation unit further calculates and outputs a service calling frequency when, as a result of that a predetermined starting point service is called, the other services are called sequentially in a chained manner.

10. The analysis system according to claim 1,

wherein the calling frequency calculation unit periodically calculates the service calling frequencies, and when the calculated service calling frequencies are different from a predetermined reference value by a predetermined difference value or more, further outputs a message to the effect that the service calling frequencies are different from the reference value.

16. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing analysis of dependencies among a plurality of server programs, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 1.

17. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing analysis of dependencies among a plurality of server programs, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 2.

18. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing analysis of dependencies among a plurality of server programs, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 5.

19. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing analysis of dependencies among a plurality of server programs, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 7.

20. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing analysis of dependencies among a plurality of server programs, the computer readable program code means in said computer program product comprising computer readable program code means for causing

a computer to effect the functions of claim 10.

11. An analysis method for analyzing dependencies among a plurality of server programs, said server programs providing services to one another operating in a computer system, said analysis method comprising:

a transaction detection step of detecting transactions in association with a service which each of the plurality of server programs performs by being called from any other server program, the transaction being processing of the service;

a child transaction candidate detection step of detecting candidates for a child transaction of each transaction detected by the transaction detection step, the child transaction being another transaction called in the transaction; and

a calling frequency calculation step of calculating and outputting service calling frequencies obtained by estimating a frequency at which each server program allows each of the other server programs to perform a service by calling the other program, the estimation being made based on the service detected in association with each transaction and on a service detected in association with the candidate for the child transaction of the transaction.

14. An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing analysis of dependencies among a plurality of server programs, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect the steps of claim 11.

15. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for analyzing dependencies among a plurality of server programs, said method steps comprising the steps of claim 11.

12. An analysis program for analyzing dependencies among a plurality of server programs by a computer, said server programs providing services to one another operating in a computer system, said analysis program allowing the computer to function as:

a transaction detection unit for detecting transactions in association with a service which each of the plurality of server programs performs by being called from any other server program, the transaction being processing of the service;

a child transaction candidate detection unit for detecting candidates for a child transaction of each transaction detected by the transaction detection unit, the child transaction being another transaction called in the transaction; and

a calling frequency calculation unit for calculating and outputting service calling frequencies obtained by estimating a frequency at which each server program allows each of the other server programs to perform a service by calling the other program, the estimation being made based on the service detected in association with each transaction and on a service detected in association with the candidate for the child transaction of the transaction.

13. A recording medium recording the analysis program according to claim 12.