ANALYSIS STACK FOR COMPLEX EVENT FLOWS

• US 20110283144A1
• Filed: 05/13/2010
• Published: 11/17/2011
• Est. Priority Date: 05/13/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Santos, Ivo José Garcia dos, Tilly, Marcel, Peray, Sebastien, Nano, Olivier, Krishnan, Ramkumar, Tarnavski, Tihomir
• Granted Patent: US 8,949,210 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

Methods, systems, and computer-readable media to analyze a CEP query are disclosed. A particular analysis module is configured to receive data associated with an event flow generated by execution of a CEP query. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow via a software communication interface. The analysis module is also configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface via the software communication interface.

Claims

1. A system, comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions, that when executed by the processor, cause execution of an event flow debugger configured to;

receive input indicating a selection of a plurality of analysis modules;

wherein a first analysis module of the selected plurality of analysis modules is operable on an event flow associated with execution of a complex event processing (CEP) query, and

wherein a second analysis module of the selected plurality of analysis modules is operable on data output from the first analysis module.

2. The system of claim 1, wherein each of the plurality of analysis modules is independently executable with respect to other analysis modules.

3. The system of claim 1, wherein the input further indicates an ordering of the plurality of analysis modules and wherein each of the plurality of analysis modules is further configured to:

receive data from a previous analysis module in the ordering; and

transmit data to a subsequent analysis module in the ordering.

4. The system of claim 3, wherein each of the plurality of analysis modules is configured to receive and transmit data via a software communication interface.

5. The system of claim 1, wherein the event flow debugger is further configured to receive input indicating a reordering of the plurality of analysis modules.

6. The system of claim 1, wherein the plurality of analysis modules comprises at least one analysis module configured to execute a partitioning analysis operation.

7. The system of claim 6, wherein the partitioning analysis operation is executable to show events at the analysis UI that are processed by a particular partition generated by a partitioning operator of the CEP query.

8. The system of claim 6, wherein the partitioning analysis operation is executable to hide events at an analysis user interface that are processed by a particular partition generated by a partitioning operator of the CEP query and to merge events that are processed by multiple partitions into events of a merged partition.

9. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute a replay analysis operation to simulate a passage of time at an analysis user interface based on one or more punctuation events.

10. The system of claim 9, wherein the replay analysis operation is further executable to:

show events at an analysis user interface (UI) having event lifetimes that include a particular point in the passage of time; and

hide events at the analysis UI having event lifetimes that do not include the particular point in the passage of time.

11. The system of claim 10, wherein the particular point in the passage of time is user-defined.

12. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute an event propagation analysis operation with respect to a particular event to identify one or more subsequent events at an analysis user interface that are affected by the particular event.

13. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute a root cause analysis operation with respect to a particular event to identify one or more previous events at an analysis user interface that affect the particular event.

14. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute a filtering analysis operation to show those events at an analysis user interface that satisfy a filtering criteria.

15. The system of claim 14, wherein the filtering criteria is based on event kinds, event start times, event end times, new event end times, event log times, event latency, event payloads, or any combination thereof.

16. The system of claim 14, wherein the filtering analysis operation is executable with respect to a particular operator of the CEP query or with respect to the entire CEP query.

17. A computer-implemented method, comprising:

receiving data representing an event flow that is based on execution of a complex event processing (CEP) query, wherein the event flow is associated with a plurality of events;

executing a first software class configured to;

retrieve a particular event from the event flow;

execute a first analysis operation on the particular event to generate a first intermediate result; and

output the first intermediate result to a subsequent software class; and

executing a second software class configured to;

receive a second intermediate result from a previous software class;

execute a second analysis operation on the second intermediate result to generate a final result; and

output the final result to an analysis user interface (UI).

18. The computer-implemented method of claim 17, further comprising executing one or more additional software classes after executing the first software class and before executing the second software class, wherein the one or more software classes are operable to generate the second intermediate result from the first intermediate result.

19. A computer-readable medium storing a complex event processing (CEP) analysis module configured to:

receive CEP analysis data associated with an event flow generated by execution of a CEP query, wherein the CEP analysis data is received from a first CEP analysis module or from the event flow, and wherein the CEP analysis data is received via a software communication interface;

execute an analysis operation on the CEP analysis data to generate a CEP analysis result; and

output the CEP analysis result to a second CEP analysis module or to a user interface via the software communication interface.

20. The computer-readable medium of claim 19, wherein the CEP analysis module comprises a software class that implements the software communication interface, wherein the CEP analysis module is selectable for inclusion in an ordered set of CEP analysis modules executable to modify the user interface, and wherein the CEP analysis module is independently executable with respect to other analysis modules in the ordered set of CEP analysis modules.