Processing of Performance Data and Structure Data from an Information Technology Environment

• US 20170255639A1
• Filed: 01/31/2017
• Published: 09/07/2017
• Est. Priority Date: 04/30/2013
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Alok Anant Bhide, Brian Bingham
• Inventors: BINGHAM, Brian, FLETCHER, Tristan, BHIDE, Alok Anant
• Granted Patent: US 10,346,357 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 11/3024 where the computing system component is a central processing unit [CPU]
• CPC Class Codes: G06F 11/3037 where the computing system component is a memory, e.g. virtual memory, cache accessing, addressing or allocating within memory systems or architectures G06F12/00; checking stores for correct operation G11C29/00
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/144 Query formulation
• CPC Class Codes: G06F 16/148 File search processing
• CPC Class Codes: G06F 16/156 Query results presentation
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/3346 using probabilistic model
• CPC Class Codes: G06F 17/40 Data acquisition and logging for input to computer G06F3/00
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2201/815 Virtual
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Claims

1. A method comprising:

acquiring, by a computer system, a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment;

acquiring, by a computer system, portions of structure data indicative of structure characteristics of the IT environment, each of the portions of structure data associated with at least one hardware or software component of the IT environment;

storing, by the computer system, the acquired performance measurements and the acquired portions of structure data;

identifying, by the computer system, a structure characteristic associated with a particular level of performance by correlating at least one of the performance measurements with at least one of the portions of structure data, based on a correlation criterion; and

causing display of an indication of the structure characteristic associated with the particular level of performance.

2. A method as recited in claim 1, wherein the correlation criterion relates to a machine in the IT environment.

3. A method as recited in claim 1, wherein the portions of structure data are derived from log data associated with at least one hardware or software component of the IT environment.

4. A method as recited in claim 1, wherein the portions of structure data are derived from log data associated with at least one hardware or software component of the IT environment, and wherein the log data is from a text-based log file.

5. A method as recited in claim 1, wherein the portions of structure data are derived from log data associated with at least one hardware or software component of the IT environment, the log data is from a text-based log file, and the plurality of performance measurements are not derived from a log file and are acquired independently of the log data.

6. A method as recited in claim 1, wherein the plurality of performance measurements are acquired without reference to log data.

7. A method as recited in claim 1, wherein the plurality of performance measurements have been acquired by direct measurement of at least one hardware or software component of the IT environment.

8. A method as recited in claim 1, wherein the portions of structure data are derived from log data associated with at least one hardware or software component of the IT environment;

the method further comprising;

acquiring the log data in the form of a plurality of portions of log data; and

storing each of the acquired portions of log data.

9. A method as recited in claim 1, wherein the portions of structure data are derived from log data associated with at least one hardware or software component of the IT environment;

the method further comprising;

acquiring the log data in the form of a plurality of portions of log data;

and wherein said storing comprises storing each of the acquired performance measurements, each of the acquired portions of structure data and each of the acquired portions of log data with a time-stamp in a time-series data store.

10. A method as recited in claim 1, wherein the correlation criterion is a time-based criterion.

11. A method as recited in claim 1, wherein the correlation criterion is not a time-based criterion.

12. A method as recited in claim 1, wherein the correlation criterion is a user-specified search criterion.

13. A method as recited in claim 1, wherein the correlation criterion is a user-specified search criterion that is not a time-based criterion.

14. A method as recited in claim 1, wherein said correlating comprises causing concurrent display of at least one performance measurement and at least one portion of structure data that each satisfy the correlation criterion.

15. A method as recited in claim 1, wherein the performance metric comprises a performance metric for at least one hardware or software resource of a computer system.

16. A method as recited in claim 1, wherein the performance metric comprises a performance metric for at least one virtual machine or virtual machine host.

17. A method as recited in claim 1, wherein the performance metric comprises a performance metric for a virtual machine cluster.

18. A method as recited in claim 1, further comprising:

obtaining the correlation criterion from a user input to a graphical user interface element that enables a user to input a search criterion as said correlation criterion but does not enable input of a complete search query.

19. A method as recited in claim 1, further comprising:

obtaining the correlation criterion from a user input to a graphical user interface element, wherein the correlation criterion relates to a machine in the IT environment.

20. A method as recited in claim 1, further comprising, prior to said correlating:

obtaining the correlation criterion from a search query input by a user into a query box in a text-based search query language.

21. A method as recited in claim 1, further comprising, prior to said correlating:

obtaining the correlation criterion from a search query input by a user into a query box in a text-based search query language, wherein the correlation criterion relates to a machine in the IT environment.

22. A method as recited in claim 1, wherein

said storing comprises storing each of the acquired performance measurements and each of the acquired portions of structure data with a time-stamp;

said correlating further comprises identifying at least one of the stored performance measurements and at least one of the stored portions of structure data that have time stamps that satisfy a user-specified time criterion.

23. A method as recited in claim 1, wherein

said storing comprises storing each of the acquired performance measurements and each of the acquired portions of structure data with a time-stamp in a time-series data store;

and said correlating comprises correlating a performance characteristic of the IT environment with a structure characteristic of the IT environment, by identifying a portion of stored structure data that has a time stamp that corresponds to a time stamp of one of the stored performance measurements.

24. A method as recited in claim 1, wherein

said storing comprises storing each of the acquired performance measurements and each of the acquired portions of structure data with a time-stamp;

said correlating comprises;

identifying a particular performance measurement; and

identifying a portion of structure data that has a time stamp most recently preceding a time stamp associated with the particular performance measurement.

25. A method as recited in claim 1, wherein the performance measurements are stored in a first time-series data store, and the portions of structure data are stored in a second time-series data store separate from the first time-series data store.

26. A method as recited in claim 1, wherein the performance measurements are stored in a time-series data store in a first format, and the portions of log data are stored in said time-series data store in a second format different from the first format.

27. A method as recited in claim 1, wherein the performance measurements are stored in a first time-series data store in a first format, and the portions of structure data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format.

28. A method as recited in claim 1, the method further comprising:

acquiring log data indicative of activity of at least one hardware or software component of the IT environment; and

storing each of the acquired portions of log data with an associated time stamp in a first time-series data store;

wherein said storing the acquired performance measurements and the acquired portions of structure data comprises storing each of the acquired performance measurements with an associated time stamp in a second time-series data store separate from the first time-series data store, and storing each of the acquired structure data with an associated time stamp in a third time-series data store separate from the first and second time-series data stores.

29. A non-transitory machine-readable storage medium for use in a processing system of a data intake and query system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:

acquiring a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment;

acquiring portions of structure data indicative of structure characteristics of the IT environment, each of the portions of structure data associated with at least one hardware or software component of the IT environment;

storing the acquired performance measurements and the acquired portions of structure data;

identifying a structure characteristic associated with a particular level of performance by correlating at least one of the performance measurements with at least one of the portions of structure data, based on a correlation criterion; and

causing display of an indication of the structure characteristic associated with the particular level of performance.

30. A system comprising:

a communication device through which to communicate on a computer network; and

at least one processor operatively coupled to the communication device and configured to perform operations including

acquiring a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment;

acquiring portions of structure data indicative of structure characteristics of the IT environment, each of the portions of structure data associated with at least one hardware or software component of the IT environment;

storing the acquired performance measurements and the acquired portions of structure data;

identifying a structure characteristic associated with a particular level of performance by correlating at least one of the performance measurements with at least one of the portions of structure data, based on a correlation criterion; and

causing display of an indication of the structure characteristic associated with the particular level of performance.