Flexible and Safe Monitoring of Computers

• US 20110320586A1
• Filed: 06/29/2010
• Published: 12/29/2011
• Est. Priority Date: 06/29/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Maltz, David A., Goldstein, Jonathan David, Greenberg, Albert, Patel, Parveen K., Loboz, Charles
• Granted Patent: US 9,274,842 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3093 Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: G06F 2209/5013 Request control
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

Described is a server monitoring technology that is scalable to large numbers of servers, e.g., in a datacenter. Agents on servers run queries to monitor data sources for that server, such as performance counters and other events. The agents monitor their resource usage and those of monitored events to stay within an administrator-specified resource budget (policy), e.g., by modifying the running queries and/or monitoring parameters. A controller receives results of the monitoring, analyzes the results, and takes action as needed with respect to server operation and monitoring. The controller may dynamically update an agent'"'"'s queries, monitoring parameters and/or monitored data post-processing operations. The controller may issue alerts and reports, including alerts indicative of inter-server problems between two or more servers.

Claims

1. In a computing environment, a system, comprising, a dynamic query engine comprising an agent that runs one or more queries on a server to collect monitoring data from one or more data sources, the query engine monitoring the agent'"'"'s resource usage with respect to a policy-specified resource budget, the query engine configured to dynamically modify one or more of the queries or monitoring parameters, or both, to remain within the policy-specified resource budget.

2. The system of claim 1 wherein the query engine computes estimates of the resource usage of creating events corresponding to the monitoring data, and includes the estimates as part of monitoring the agent'"'"'s resource usage.

3. The system of claim 1 wherein the query engine includes a scheduler that dynamically modifies a query by pausing the query, suspending the query, stopping the query or changing a resource priority of the query.

4. The system of claim 1 wherein the query engine dynamically modifies one or more of the queries or monitoring parameters by sampling to obtain less than all of the data provided by a data source, or by combining the data provided by a data source into a lesser amount of data, or both by sampling to obtain less than all of the data provided by a data source and by combining the data provided by a data source into a lesser amount of data.

5. The system of claim 1 wherein the query engine logs at least some of the data provided by a data source for later processing when more resources are available.

6. The system of claim 1 wherein the policy-specified resource budget corresponds to defined policy for the server, the defined policy comprising a subordinate policy that is configured to control the resource usage by changing at least one monitoring parameter, performing sampling, or combining data into a lesser amount of data, or any combination of changing at least one monitoring parameter, performing sampling, or combining data into a lesser amount of data, and a super-policy that is configured to control resource usage by pausing one or more queries, suspending one or more queries, stopping one or more queries or changing a resource priority of one or more queries if the subordinate policy is unable to control the resource usage to remain within the policy-specified resource budget.

7. The system of claim 1 wherein the query engine performs post-processing on the monitoring data to provide monitoring results for delivery to a data warehouse.

8. The system of claim 7 further comprising a controller that analyzes the monitoring results.

9. The system of claim 1 wherein the query engine receives one or more new queries or one or more new monitoring parameters, or both, and in response, changes one or more of the data sources, one or more of the queries being run, one or more of the monitoring parameters, or one or more post-processing operations on the data, or any combination of one or more of the data sources, one or more of the queries being run, one or more of the monitoring parameters, or one or more post-processing operations on the data.

10. The system of claim 1 wherein output of one query is used as input of another query in the query engine, or wherein output of one query is used as input of another query in another query engine, or wherein output of one query is used as input of another query in the query engine and as input of yet another query in another query engine.

11. In a computing environment, a system comprising, a controller that receives results corresponding to monitoring data collected from servers, the controller configured to perform an analysis on the results for a server, and to reconfigure one or more queries or one or more monitoring parameters, or both, used by an agent on that server so as to alter the monitoring data collected by that server based upon the analysis.

12. The system of claim 11 wherein the agent post-processes the monitoring data into the results, and wherein the controller reconfigures the post-processing performed by the agent so as to obtain a different type of results.

13. The system of claim 11 wherein the controller processes historical data to determine one or more patterns corresponding to previous operating states of the server, and wherein the analysis is based at least in part upon a comparison of the results that indicate a current operating state of the server versus one or more of the patterns.

14. The system of claim 11 wherein the controller outputs an alert, or a report, or both an alert and a report based upon the analysis, and wherein the controller is configured to use the analysis associated with the server and another analysis associated with another server to output an alert corresponding to an inter-server problem.

15. The system of claim 11 wherein the controller uses the analysis associated with the server to configure another server running a similar or same application as the server, or having similar or the same machine configuration parameters, or both to configure another server running a similar or same application as the server and having similar or the same machine configuration parameters.

16. The system of claim 11 wherein the controller separates a query into an online component and an offline component, the controller reconfiguring the agent with the online component, and using the offline component to combine results from the server corresponding to the online component with results received from another server.

17. In a computing environment, a method performed on at least one processor comprising:

receiving results corresponding to monitoring data of a monitored server, in which the results are obtained based upon a monitoring information set comprising one or more queries or one or more monitoring parameters, or one or more queries and one or more monitoring parameters,

analyzing the results;

modifying the monitoring information set into a modified monitoring information set; and

communicating the modified monitoring information set to the monitored server.

18. The method of claim 17 wherein the information set includes post-processing data corresponding to a format of the results, and further comprising, receiving other results in a different format based upon the post-processing data.

19. The method of claim 17 wherein modifying the monitoring information set comprises including at least one query or monitoring parameter based upon health metrics.

20. The method of claim 17 further comprising, processing historical data to obtain a historical pattern, and wherein modifying the monitoring information set comprises including at least one query or monitoring parameter based upon the results relative to the historical pattern.