Apparatus, system, and method for gathering trace data indicative of resource activity

• US 20060047805A1
• Filed: 08/10/2004
• Published: 03/02/2006
• Est. Priority Date: 08/10/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Klingenberg, Bernhard Julius, Hillsberg, Bruce Light, Byrd, Stephen A., Czerwinski, Steven, Krishnan, Rajesh Francisco, Thirumalai, Balaji, Fox, J. Kristofer
• Granted Patent: US 7,661,135 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3495 for systems

Abstract

An apparatus, system, and method are provided for gathering trace data indicative of resource activity on a computer system. The present invention includes a monitoring module that initiates one or more activity monitors on a target computer system to detect different types of resource activity. A determination module determines activity indicators involving resources of the target computer system using the one or more activity monitors. The activity indicators may comprise a variety of information useful in identifying one or more separate resource activities. A collection module organizes the activity indicators into trace data representative of the resource activity. Preferably, the monitoring module, determination module, and collection module operate continuously on the target computer system. In this manner, the trace data includes an accurate set of both current activity indicators as well as historical activity indicators.

Claims

1. An apparatus to gather trace data indicative of resource activity on a computer system, the apparatus comprising:

a monitoring module configured to initiate an activity monitor on a target computer system, the activity monitor configured to detect a specific type of resource activity;

a determination module closely coupled to the target computer system and configured to determine activity indicators involving resources of the target computer system by way of the activity monitor; and

a collection module configured to organize the activity indicators into trace data representative of the resource activity, the trace data comprising current activity indicators and historical activity indicators.

2. The apparatus of claim 1, wherein the monitoring module initiates a plurality of modular activity monitors, each activity monitor configured to detect a different type of resource activity independent of other activity monitors and wherein the trace data is organized according to a standard data exchange format, the apparatus further comprising an Application Programming Interface (API) configured to communicate at least a portion of the trace data to a third-party computer process in response to a request.

3. The apparatus of claim 1, further comprising a storage module configured to store the trace data in a central repository.

4. The apparatus of claim 1, wherein the activity monitor comprises a low-level driver that receives all I/O communication for a class of peripheral devices of the target computer system.

5. The apparatus of claim 1, further comprising a launch module configured to initiate selected activity monitors in response to user-defined time criteria and further in response to occurrence of a predefined event on the target computer system.

6. The apparatus of claim 1, wherein the determination module is configured to determine substantially all activity indicators available from hardware and software components of the target computer system.

7. A system to gather trace data indicative of resource activity on a computer system, comprising:

an operating system configured to manage execution of processes;

a process manager configured to provide information on running processes;

an Input/Output (I/O) module configured to provide file activity car information;

a file system configured to manage files stored in storage and provide metadata about the files;

a monitoring module configured to initiate an activity monitor on the system, the activity monitor configured to detect a specific type of resource activity, the activity monitor interacting with at least one of the process manager, the I/O module, and the file system;

a determination module of the activity monitor that is configured to determine activity indicators involving resources of the system; and

a collection module of the activity monitor configured to organize the activity indicators into trace data representative of the resource activity, the trace data comprising current activity indicators and historical activity indicators.

8. The system of claim 7, wherein the trace data is organized according to a standard data exchange format and includes current activity indicators and historical activity indicators, the monitoring module further configured to communicate the trace data to a third-party computer process in response to a request from the third-party computer process, the request conforming to an Application Programming Interface (API).

9. The system of claim 7, further comprising a storage module configured to store the trace data in a central repository.

10. The system of claim 7, wherein the activity monitor comprises a low-level I/O module that receives all I/O communication for a class of peripheral devices of the system.

11. The system of claim 7, wherein the monitoring module initiates a plurality of activity monitors, at least one activity monitor initiated according to a schedule determined by a user-configurable attribute for the at least one activity monitor, the at least one activity monitor ceasing operation in response to completing determination of a specific type of resource activity.

12. The system of claim 11, wherein the monitoring module is further configured to initiate at least one activity monitor that continuously executes on the target computer system and determines activity indicators in response to select system events.

13. The system of claim 11, wherein the activity monitors are modular such that select activity monitors are replaceable and modifiable and new activity monitors can be added without affecting other activity monitors within the plurality of activity monitors.

14. The system of claim 7, wherein the activity indicators comprise substantially all resource attributes indicative of activities involving a particular resource.

15. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to gather trace data indicative of resource activity on a computer system, the operations comprising:

an operation that initiates an activity monitor on a target computer system, the activity monitor configured to detect a specific type of resource activity;

an operation that determines activity indicators involving resources of the target computer system by way of the activity monitor; and

an operation that organizes the activity indicators into trace data representative of the resource activity, the trace data comprising current activity indicators and historical activity indicators.

16. The signal bearing medium of claim 15, further comprising initiating a plurality of modular activity monitors, each activity monitor configured to detect a different type of resource activity independent of other activity monitors and wherein the apparatus further comprising an operation that communicates at least a portion of the trace data to a third-party computer process in response to a request that conforms to an Application Programming Interface (API).

17. The signal bearing medium of claim 15, further comprising an operation that stores the trace data in a central repository.

18. The signal bearing medium of claim 15, wherein the activity monitor comprises a low-level driver that receives all I/O communication for a class of peripheral devices of the target computer system.

19. The signal bearing medium of claim 16, wherein the operation that initiates an activity monitor is further configured to initiate selected activity monitors in response to user-defined time criteria and other select activity monitors in response to occurrence of a predefined event on the target computer system.

20. The signal bearing medium of claim 15, wherein the operation that determines activity indicators is further configured to determine substantially all activity indicators available from hardware and software components of the target computer system.

21. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to gather trace data indicative of resource activity on a computer system, the operations comprising:

an operation that initiates at least two activity monitors on a target computer system, each activity monitor configured to detect a specific type of resource activity;

an operation that determines activity indicators involving resources of the target computer system by way of each activity monitor; and

an operation that organizes the activity indicators from each activity monitor into trace data representative of various types of resource activities determined by the plurality of activity monitors.

22. The signal bearing medium of claim 21, wherein the trace data is organized according to a standard data exchange format and includes current activity indicators and historical activity indicators, the operations further comprising an operation to communicate the trace data to a third-party computer process in response to a request from the third-party computer process, the request conforming to an Application Programming Interface (API).

23. The signal bearing medium of claim 21, further comprising an operation to store the trace data in a central repository.

24. The signal bearing medium of claim 21, wherein at least one activity monitor comprises a low-level I/O module that receives all I/O communication for a class of peripheral devices of the target computer system.

25. The signal bearing medium of claim 21, wherein the operation that initiates the plurality of activity monitors initiates at least one activity monitor according to a schedule determined by a user-configurable attribute for the at least one activity monitor, the at least one activity monitor ceasing operation in response to completing determination of a specific type of resource activity.

26. The signal bearing medium of claim 21, wherein the operation that initiates the plurality of activity monitors is further configured to initiate at least one activity monitor that continuously executes on the target computer system and determines activity indicators in response to select system events.

27. The signal bearing medium of claim 21, wherein the activity monitors are modular such that select activity monitors can be replaced or modified and new activity monitors can be added without affecting other activity monitors within the plurality of activity monitors.

28. The signal bearing medium of claim 21, wherein the activity indicators comprise substantially all resource attribute indicative of activities involving a particular resource.

29. A method for gathering trace data indicative of resource activity on a computer system, the method comprising:

initiating a plurality of modular activity monitors on a target computer system, each activity monitor configured to detect a specific type of resource activity;

determining activity indicators involving resources of the target computer system by way of each activity monitor; and

organizing the activity indicators from each activity monitor into trace data representative of various types of resource activities determined by the plurality of activity monitors.

30. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to gather trace data indicative of resource activity on a computer system, the operations comprising:

an operation that initiates at least two activity monitors on a target computer system, each activity monitor configured to detect a specific type of resource activity;

an operation that implements a means for determining activity indicators involving resources of the target computer system by way of each activity monitor; and

an operation that implements a means for organizing the activity indicators from each activity monitor into trace data representative of various types of resource activities determined by the plurality of activity monitors.