Adjusting sliding window parameters in intelligent event archiving and failure analysis

• US 7,661,032 B2
• Filed: 01/06/2007
• Issued: 02/09/2010
• Est. Priority Date: 01/06/2007
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Miller, Steven M., Subramanian, Balan, Jemiolo, Daniel E., Eberbach, Andrew M.
• Primary Examiner(s): Beausoliel; Robert
• Assistant Examiner(s): Lottich; Joshua P
• Application Number:
  US11/620,649
• Publication Number:
  US 20080168308A1
• Time in Patent Office: 1,130 Days
• Field of Search: 714/26, 714/37, 714/38, 714/39, 714/45, 714/47, 707/202
• US Class Current: 714/38.14
• CPC Class Codes: G06F 11/008 Reliability or availability analysis

Abstract

A computerized method, program product, and an autonomic data processing system that oversees real-time log data acquired by a logging application of an executing computer program. In response to an event occurring, the logging application communicates the occurrence of the event to an event correlation engine, and invokes a window-resizing module. If the event is part of a symptom of processing problems developing, then the window-resizing module immediately expands the amount of real-time log data that is retained in temporary memory to include not log data including the event but also log data during the time duration of the symptom. In conjunction with a information level module, the granularity or level of information of the log data that is archived increases immediately upon the event so that not only is more time of the log-data but also a higher information level of the log data is saved for symptom analysis and verification. It is contemplated that the method, program product, and the autonomic data processing system may be in a learning mode to acquire data and recognize events that constitute a symptom.

Claims

1. A method of capturing additional real-time log data of an executing application comprising the steps of:

retaining real-time log data of the executing application in a temporary memory;

receiving notice of a first event at a first time;

recognizing that the first event is part of a symptom;

determining the time duration of the symptom;

extending the time period of real-time log data retained in the temporary memory from the first time to the time duration of the symptom.

2. The method of claim 1, wherein the step of extending the time period of real-time log data further comprises allocating more temporary memory to a logging application.

3. The method of claim 1, further comprising archiving the real-time log data at a first information level.

4. The method of claim 3, further comprising changing the information level of the real-time log data archived in response to the first event.

5. The method of claim 3, further comprising changing the information level of the real-time log data archived in response to recognition of the symptom.

6. The method of claim 1, wherein the step of recognizing that the first event is part of a symptom further comprises:

archiving historical log data of every first event that occurred when the application executed;

correlating the occurrence of the first event with a plurality of subsequent events;

determining the likelihood that the plurality of subsequent events occurred whenever the first event occurred

recording the time duration from the occurrence of the first event to the last of the plurality of subsequent events;

learning that the first event and the plurality of subsequent events constitutes a symptom having the time duration; and

recording the symptom and the time duration.

7. The method of claim 1, further comprising:

initiating remedial action to minimize any problem that may result from the symptom.

8. A computer program product in a computer-readable storage medium comprising a computer usable medium having computer usable program code, wherein the computer usable program code, when loaded into the internal memory of a processing device, causes the processing device to:

log an executing application in real time;

retain real-time log data from logging the executing application in a temporary memory, the temporary memory capable of retaining an amount of real-time log data for a specified time window;

notice the occurrence of a first event at a first time from the real-time log data;

anticipate a future event in a future time; and

extend the specified time window for the amount of real-time log data retained in the temporary window from before or at the first time to the future time.

9. The computer program product in a computer-readable storage medium of claim 8 comprising a computer usable medium having computer usable program code, wherein the computer usable program code, when loaded into the internal memory of a processing device, causes the processing device to allocate more temporary memory thereby extending the specified time window for the amount of real-time log data retained in the temporary window from before or at the first time to the future time.

10. The computer program product in a computer-readable storage medium of claim 8 comprising a computer usable medium having computer usable program code, wherein the computer usable program code, when loaded into the internal memory of a processing device, causes the processing device to archive a portion of the real-time log data at a first information level.

11. The computer program product in a computer-readable storage medium of claim 9 comprising a computer usable medium having computer usable program code, wherein the computer usable program code, when loaded into the internal memory of a processing device, causes the processing device to change the information level of the archived portion of the real-time log data in response to the first event.

12. The computer program product in a computer-readable storage medium of claim 8 comprising a computer usable medium having computer usable program code, wherein the computer usable program code, when loaded into the internal memory of a processing device, causes the processing device to:

execute the executing application in the processing device;

execute a logging application to log the executing application in real-time;

initialize an event correlation engine connected to the logging application;

the logging application recording the occurrence of the first event at the first time;

the event correlation engine receiving notification from the logging application of the first event;

the event correlation engine recognizing that the first event is part of a symptom having an extended time duration from before or at the first time to the future time;

the event correlation engine informing the logging application of the symptom and the extended time duration;

the logging application retaining real-time log data from before or at the first time through the extended time duration in temporary memory.

13. The computer program product in a computer-readable storage medium of claim 12, comprising a computer usable medium having computer usable program code, wherein the computer usable program code, when loaded into the internal memory of a processing device, causes the processing device to archive the real-time log data from before or at the first time through the extended time duration.

14. An autonomic data processing system, comprising:

a first data processing device executing an application;

a second data processing device executing a logging application to obtain real-time log data of the executing application in the first data processing device;

a temporary memory to receive the real-time log data of the executing application from the logging application;

an event correlation engine connected to the logging application;

a window resizing module connected to the logging application and to the event correlation engine and to the temporary memory wherein when the logging application records and communicates an event occurring in the real-time log data of the executing application to the event correlation engine, the event correlation engine recognizes the event as being part of a symptom having a time duration, the event correlation engine communicates to the window-resizing module to increase the amount of real-time log data retained in the temporary memory from the time of the event to include at least the time duration of the symptom.

15. The autonomic data processing system of claim 14, further comprising:

an archival memory connected to the temporary memory;

an information level module connected to the logging application and to the event correlation engine, whereby the information level module increases the information level of real-time log data of the executing application that is transferred from the temporary memory to the archival memory in response to the first event.

16. The autonomic data processing system of claim 14, further comprising:

an archival memory connected to the temporary memory;

an information level module connected to the logging application and to the event correlation engine, whereby the information level module increases the information level of real-time log data of the executing application that is transferred from the temporary memory to the archival memory in response to recognition of the symptom by the event correlation engine.

17. The autonomic data processing system of claim 14 wherein the event correlation engine further comprises a learning module whereby the real-time log data archived in the archival memory is compared with the symptom to learn which, if any, of a plurality of events precedes any problem caused by the symptom occurring in the autonomic data processing system.

18. The autonomic data processing system of claim 14 wherein the logging application communicates recognition of the symptom to a remedial module that takes corrective action to prevent the problem indicated by the symptom.

19. The autonomic data processing system of claim 14 whereby a remedial module removes a component from the autonomic data processing, the component causing or reacting to the problem indicated by the symptom.