Method and apparatus for correlating output of distributed processes

• US 7,454,761 B1
• Filed: 12/20/2002
• Issued: 11/18/2008
• Est. Priority Date: 12/20/2002
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Dini, Petre, Hasan, Masum Z., Roberts, Kenneth J.
• Primary Examiner(s): An; Meng-Ai
• Assistant Examiner(s): Anya; Charles E
• Application Number:
  US10/327,225
• Time in Patent Office: 2,160 Days
• Field of Search: 714 25- 27, 714/31, 714 42- 49, 714/57, 718/106, 719/320, 719/318, 717127-128
• US Class Current: 719/318
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

A method for correlating output of distributed processes includes receiving certain information at a first process of multiple distributed processes that perform one computer application. The information includes a unique identifier for a particular instance of the application that is different from any other identifier for any other instance of the application. The unique identifier is included in data written by the first process to a first data structure. Based on the unique identifier, the data in the first data structure is correlated with data in a different, second data structure written by a different, second process.

Claims

1. A method of correlating output of distributed processes related to a computer application, the method comprising the computer-implemented steps of:

receiving, at an output viewing process output from a first event log file, written by a first process of a plurality of distributed processes that perform one computer application, wherein the first event log file contains first event data including at least one of;

a first unique identifier for a first instance of the computer application, wherein the first unique identifier is different from any other identifier for any other instance of the computer application; and

a set comprising the first unique identifier and a third unique identifier received from a third process of a plurality of distributed processes, different from the first process;

receiving, at the output viewing process output from a second event log file written by a second process of the plurality of distributed processes, wherein the second event log file contains second event data including a second unique identifier for a second instance of the computer application, wherein the second unique identifier is different from any other identifier for any other instance of the computer application;

determining, whether the first event data is correlated with the second event data based on whether the second unique identifier is the same as at least one of the first unique identifier and the third identifier; and

presenting at least a portion of the output from the first event log file and the second event log file in response to determining whether the first event data is correlated with the second event data and based on whether the first unique identifier is the same as the second unique identifier

wherein each instance of the computer application is associated with no more than one unique identifier.

2. A method as recited in claim 1, wherein the third process is different from the second process.

3. A method as recited in claim 1, wherein the third process is the same as the second process.

4. The method as recited in claim 1, wherein the third unique identifier is appended to the first unique identifier.

5. The method as recited in claim 1, further comprising including the first unique identifier in third event data passed to invoke the third process by the first process.

6. The method as recited in claim 5, wherein the third process is the same as the first process.

7. The method as recited in claim 5, wherein the third process is different from the first process.

8. The method as recited in claim 5, wherein the third process is the same as the second process.

9. The method as recited in claim 5, wherein the third process is different from the second process.

10. The method as recited in claim 1, wherein the first unique identifier is included in the first event data written by the first process to indicate a fault detected by the first process.

11. The method as recited in claim 1, wherein said step of determining whether the first event data is correlated with the second event data does not include determining a time difference between a first timestamp associated with the first data and a second timestamp associated with the second data.

12. The method as recited in claim 1, wherein the first event data is logged by one instance of the first process, and includes data that describes a fault detected by the first process.

13. A computer-readable tangible storage medium carrying one or more sequences of instructions for correlating output of distributed processes related to a computer application, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving, at an output viewing process output from a first event log file, written by a first process of a plurality of distributed processes that perform one computer application, wherein the first event log file contains first event data including at least one of;

a first unique identifier for a first instance of the computer application, wherein the first unique identifier is different from any other identifier for any other instance of the computer application; and

a set comprising the first unique identifier and a third unique identifier received from a third process of a plurality of distributed processes, different from the first process;

receiving, at the output viewing process output from a second event log file written by a second process of the plurality of distributed processes, wherein the second event log file contains second event data including a second unique identifier for a second instance of the computer application, wherein the second unique identifier is different from any other identifier for any other instance of the computer application;

determining, whether the first event data is correlated with the second event data based on whether the second unique identifier is the same as at least one of the first unique identifier and the third identifier; and

presenting at least a portion of the output from the first event log file and the second event log file in response to determining whether the first event data is correlated with the second event data and based on whether the first unique identifier is the same as the second unique identifier

wherein each instance of the computer application is associated with no more than one unique identifier.

14. The computer-readable tangible storage medium as recited in claim 13, wherein the instructions further comprise instructions for carrying out the step of including the first unique identifier in third event data passed to invoke the third process by the first process.

15. A computer-readable tangible storage medium as recited in claim 13, wherein the first unique identifier is included in the first event data written by the first process to indicate a fault detected by the first process.

16. An apparatus for correlating output of distributed processes related to a computer application, having one or more processors comprising:

means for receiving, at an output viewing process output from a first event log file, written by a first process of a plurality of distributed processes that perform one computer application, wherein the first event log file contains first event data including at least one of;

a first unique identifier for a first instance of the computer application, wherein the first unique identifier is different from any other identifier for any other instance of the computer application; and

a set comprising the first unique identifier and a third unique identifier received from a third process of a plurality of distributed processes, different from the first process;

means for receiving, at the output viewing process output from a second event log file written by a second process of the plurality of distributed processes, wherein the second event log file contains second event data including a second unique identifier for a second instance of the computer application, wherein the second unique identifier is different from any other identifier for any other instance of the computer application;

means for determining, whether the first event data is correlated with the second event data based on whether the second unique identifier is the same as at least one of the first unique identifier and the third identifier; and

means for presenting at least a portion of the output from the first event log file and the second event log file in response to determining whether the first event data is correlated with the second event data and based on whether the first unique identifier is the same as the second unique identifier,

wherein each instance of the computer application is associated with no more than one unique identifier.

17. The apparatus of claim 16, further comprising means for including the first unique identifier in third event data passed to invoke a third process by the first process.

18. The apparatus of claim 16, wherein the first unique identifier is included in the first event data written by the first process to indicate a fault detected by the first process.

19. An apparatus for creating and storing troubleshooting information for diagnosing one or more problems experienced in one or more completed voice calls that are carried by a packet-switched data network, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out;

receiving, at an output viewing process output from a first event log file, written by a first process of a plurality of distributed processes that perform one computer application, wherein the first event log file contains first event data including at least one of;

a first unique identifier for a first instance of the computer application, wherein the first unique identifier is different from any other identifier for any other instance of the computer application; and

a set comprising the first unique identifier and a third unique identifier received from a third process of a plurality of distributed processes, different from the first process;

receiving, at the output viewing process output from a second event log file written by a second process of the plurality of distributed processes, wherein the second event log file contains second event data including a second unique identifier for a second instance of the computer application, wherein the second unique identifier is different from any other identifier for any other instance of the computer application;

determining, whether the first event data is correlated with the second event data based on whether the second unique identifier is the same as at least one of the first unique identifier and the third identifier; and

presenting at least a portion of the output from the first event log file and the second event log file in response to determining whether the first event data is correlated with the second event data and based on whether the first unique identifier is the same as the second unique identifier,

wherein each instance of the computer application is associated with no more than one unique identifier.

20. The apparatus of claim 19, further comprising instructions which when executed cause performing including the first unique identifier in third event data passed to invoke the third process by the first process.

21. The apparatus of claim 19, wherein the first unique identifier is included in the first event data written by the first process to indicate a fault detected by the first process.