Use of execution flow shape to allow aggregate data reporting with full context in an application manager

• US 8,341,605 B2
• Filed: 12/15/2005
• Issued: 12/25/2012
• Est. Priority Date: 12/15/2005
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Cobb, Jeffrey R., Puryear, Daryl L., Vanrenen, Gabriel J.
• Primary Examiner(s): Tecklu, Isaac
• Assistant Examiner(s): Aguilera, Todd
• Application Number:
  US11/304,040
• Publication Number:
  US 20070143743A1
• Time in Patent Office: 2,567 Days
• Field of Search: 717127-133, 714/39, 709/201
• US Class Current: 717/130
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/87 Monitoring of transactions
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: H04L 65/75 Media network packet handling

Abstract

Data relating to execution flows at a computer system is aggregated across multiple execution flows by categorizing each execution flow into an execution flow shape. The execution flows may represent sequences of software components that are invoked or other computer system resources that are consumed. The execution flow shapes are developed by observing and recording the execution flows at the computer system and applying lossy compression rules. Execution flows are categorized into an execution flow shape which is a closest match. The execution flow data may be aggregated by an agent at the computer system, and communicated to a manager for subsequent use. The aggregation combines the information from all execution flows into a small enough data set that can be reported without consuming unduly large processing overhead while still preserving as many of the interesting aspects of the execution flows as possible.

Claims

1. A computer-implemented method for monitoring an application running at a first computer system, comprising the computer-implemented steps of:

receiving information from probes of instrumented byte code of the application, the information is used to provide a plurality of execution flows at the application, each of the plurality of execution flows comprising a sequence of invoked software components, the information identifies start and stop times of the invoked software components, and start and stop times of the execution flows;

categorizing the plurality of execution flows into a single execution flow shape selected from a plurality of execution flow shapes, so that different sequences of invoked software components of the plurality of execution flows are represented by a single sequence of software components of the single execution flow shape, the categorizing comprises, for each of the plurality of execution flows, calculating distances which represent how closely the execution flow matches each of the plurality of execution flow shapes and selecting the single execution flow shape based on a smallest distance among the distances;

calculating execution times of the invoked software components of the plurality of execution flows which correspond to the software components of the single sequence of software components based on the start and stop times of the invoked software components;

calculating execution times of the plurality of execution flows based on the start and stop times of the plurality of execution flows;

providing slowest and fastest execution times and at least one of a median and a mean execution time of the software components of the single sequence of software components based on the calculating of the execution times of the invoked software components, and providing slowest and fastest execution times and at least one of a median and a mean execution time of the single execution flow shape, based on the calculating of the execution times of the plurality of execution flows; and

reporting from the first computer system to a manager computer system;

(i) the single execution flow shape, (ii) the slowest and fastest execution times and the at least one of the median and the mean execution time, for the software components of the single sequence of software components, and (iii) the slowest and fastest execution times and the at least one of the median and the mean execution time of the single execution flow shape, wherein one execution flow of the plurality of execution flows is provided by performing lossy compression on an uncompressed execution flow to reduce the uncompressed execution flow to a simplified form comprising a reduced number of components, and the one execution flow and the uncompressed execution flow are discarded once the plurality of execution flows have been categorized so that the one execution flow and the uncompressed execution flow are not reported from the first computer system to the manager computer.

2. The computer-implemented method of claim 1, wherein:

the plurality of execution flows are associated with multiple computer systems; and

the categorizing and the reporting are performed at the multiple computer systems.

3. The computer-implemented method of claim 1, wherein:

the one execution flow spans at least one of a thread and a process.

4. The computer-implemented method of claim 1, wherein:

data from the one execution flow is obtained and aggregated before data from all of the plurality of execution flows has been obtained.

5. The computer-implemented method of claim 1, wherein:

the computer-implemented method is performed by agent software of the first computer system.

6. The computer-implemented method of claim 1, further comprising:

combining information from each execution flow that occurs at the application during the monitoring of the application, into a data set that is reported from the first computer system to the manager computer, rather than using sampling in which information is lost for a particular execution flow of the application which is not selected for sampling.

7. A non-transitory processor readable storage device comprising processor readable code embodied thereon for programming a processor to perform the computer-implemented method of claim 1.

8. The computer-implemented method of claim 1, wherein:

the plurality of execution flows, the execution times of the plurality of execution flows, and the execution times of the invoked software components of the plurality of execution flows which correspond to the software components of the single sequence of software components of the single execution flow shape, are discarded without being reported.

9. The computer-implemented method of claim 1, further comprising:

responsive to the categorizing, determining a quantity of the execution flows which were categorized into the single execution flow shape; and

reporting the quantity from the first computer system to the manager computer system.

10. The computer-implemented method of claim 1, wherein:

each of the plurality of execution flows represents a transaction in which the sequence of invoked software components is represented by start and finish nodes for each invoked software component in the transaction.

11. The computer-implemented method of claim 10, wherein:

the start and stop times of the plurality of execution flows are start and stop times of the transactions.

12. The computer-implemented method of claim 10, wherein:

for each of the plurality of execution flows, a first of the start nodes indicates a start of the transaction and a last of the finish nodes indicates a finish of the transaction.

13. A computer-implemented method for monitoring an application running at a computer system, comprising the computer-implemented steps of:

observing a plurality of execution flows at the application, the observing comprises receiving information from probes of instrumented byte code of the application, the information comprises data from the plurality of execution flows, the observing is performed by agent software running at the computer system;

defining a plurality of execution flow shapes based on the observing, including a single execution flow shape which represents different execution flows of the plurality of execution flows which invoke different sequences of software components, each execution flow shape of the plurality of execution flow shapes comprise an ordered sequence of invoked software components, the single execution flow shape is a single ordered sequence of software components which represents different ordered sequences of the different execution flows, and the different ordered sequences have different invoked software components;

categorizing the plurality of execution flows into a single execution flow shape selected from the plurality of execution flow shapes;

calculating execution times of the invoked software components of the different execution flows which correspond to the software components of the single ordered sequence of software components based on start and stop times in the information of the invoked software components of the different execution flows;

calculating execution times of the different execution flows based on start and stop times in the information of the different execution flows; and

providing slowest and fastest execution times and at least one of a median and a mean execution time of the software components of the single ordered sequence of software components based on the calculating of the execution times of the invoked software components, and providing slowest and fastest execution times and at least one of a median and a mean execution time of the single execution flow shape based on the calculating execution times of the different execution flows, wherein one execution flow of the plurality of execution flows is provided by performing lossy compression on an uncompressed execution flow to reduce the uncompressed execution flow to a simplified form comprising a reduced number of components, and the one execution flow and the uncompressed execution flow are discarded once the plurality of execution flows have been categorized so that the one execution flow and the uncompressed execution flow are not reported from the computer system to a manager computer.

14. The computer-implemented method of claim 13, further comprising the computer-implemented step of:

once the execution flows have been categorized, reporting to the manager computer a quantity of the execution flows which were categorized into each execution flow shape.

15. The computer-implemented method of claim 13, wherein:

the observing comprises observing sequences of software components which are invoked for the execution flows; and

the defining comprises grouping analogous observed sequences.

16. The computer-implemented method of claim 13, wherein:

the one of the execution flows spans at least one of a thread and a process.

17. A computer-implemented method for monitoring an application running at a computer system, comprising the computer-implemented steps of:

receiving aggregated data from the computer system, agent software running at the computer system receives information from probes of instrumented byte code of the application, the aggregated data representing execution flows which were categorized by the agent software based on the information from the probes into a corresponding execution flow shape selected from a plurality of available execution flow shapes, including multiple different execution flows which were categorized into a single execution flow shape, the multiple different execution flows invoke different sequences of software components, such that different ordered sequences of the multiple different execution flows are categorized into a single ordered sequence of software components of the single execution flow shape, and the different ordered sequences have different invoked software components;

the aggregated data comprising slowest and fastest execution times and at least one of a median and a mean execution time of the software components of the single ordered sequence of software components, and slowest and fastest execution times and at least one of a median and a mean execution time of the single execution flow shape;

the slowest and fastest execution times and the at least one of the median and the mean execution time of the software components of the single ordered sequence of software components, are calculated from execution times of the software components of the multiple different execution flows which correspond to the software components of the single ordered sequence of software components based on start and stop times of the software components of the multiple different execution flows;

the slowest and fastest execution times and at least one of the median and the mean execution time of the single execution flow shape, are calculated from execution times of the plurality of execution flows based on start and stop times of the plurality of execution flows; and

storing the aggregated data for subsequent use, wherein one execution flow of the plurality of execution flows is provided by performing lossy compression on an uncompressed execution flow to reduce the uncompressed execution flow to a simplified form comprising a reduced number of components, and the one execution flow and the uncompressed execution flow are discarded once the execution flows have been categorized so that the one execution flow and the uncompressed execution flow are not reported from the computer system to a manager computer.

18. The computer-implemented method of claim 17, wherein:

the aggregated data comprises performance data associated with each of the execution flow shapes.

19. The computer-implemented method of claim 17, wherein:

each of the available execution flow shapes represents a sequence of software components which are invoked.

20. The computer-implemented method of claim 17, further comprising:

receiving aggregated data from multiple computer systems, the aggregated data represents execution flows which were categorized by agent software at each computer system based on received information from probes of instrumented byte code of an application at each computer system.

21. The computer-implemented method of claim 17, wherein:

the aggregated data indicates a quantity of the execution flows which were categorized into each of the execution flow shapes.

22. The computer-implemented method of claim 17, wherein:

the one of the execution flows spans at least one of a thread and a process.

23. The computer-implemented method of claim 17, wherein:

the aggregated data combines information from each execution flow that occurs at the application during the monitoring of the application, into a data set that is reported by the computer system, rather than using sampling in which information is lost for a particular execution flow of the application which is not selected for sampling.

24. A non-transitory processor readable storage device comprising processor readable code embodied thereon for programming a processor to perform the computer-implemented method of claim 17.

25. A non-transitory processor readable storage device comprising processor readable code embodied thereon for programming at least one processor to perform a method for monitoring an application running at a computer system, the method comprising:

observing a plurality of execution flows at the application, the observing comprises receiving information from probes of instrumented byte code of the application, the information comprises data from the plurality of execution flows, the observing is performed by agent software running at the computer system;

defining a plurality of execution flow shapes based on the observing, the plurality of execution flow shapes comprising a single execution flow shape which represents different execution flows of the plurality of execution flows which invoke different sequences of software components, each execution flow shape of the plurality of execution flow shapes comprises an ordered sequence of invoked software components, the single execution flow shape is a single ordered sequence of software components which represents different ordered sequences of the different execution flows, and the different ordered sequences have different invoked software components;

categorizing the plurality of execution flows into a single execution flow shape selected from the plurality of execution flow shapes;

calculating execution times of the invoked software components of the different execution flows which correspond to the software components of the single ordered sequence of software components based on start and stop times in the information of the invoked software components of the different execution flows;

calculating execution times of the different execution flows based on start and stop times in the information of the different execution flows; and

providing slowest and fastest execution times and at least one of a median and a mean execution time of the software components of the single ordered sequence of software components based on the calculating execution times of the invoked software components, and providing slowest and fastest execution times and at least one of a median and a mean execution time of the single execution flow shape based on the calculating execution times of the different execution flows, wherein one execution flow of the plurality of execution flows is provided by performing lossy compression on an uncompressed execution flow to reduce the uncompressed execution flow to a simplified form comprising a reduced number of components, and the one execution flow and the uncompressed execution flow are discarded once the plurality of execution flows have been categorized so that the one execution flow and the uncompressed execution flow are not reported from the computer system to a manager computer.

26. The processor readable storage device of claim 25, wherein the method performed by the at least one processor further comprises:

once the execution flows have been categorized, reporting to the manager computer a quantity of the execution flows which were categorized into each execution flow shape.

27. The processor readable storage device of claim 25, wherein:

the observing comprises observing sequences of software components which are invoked for the plurality of execution flows; and

the defining comprises grouping analogous observed sequences.

28. The processor readable storage device of claim 25, wherein:

the one of the execution flows spans at least one of a thread and a process.

29. The processor readable storage device of claim 25, wherein:

the defining comprises compressing data representing the execution flows using lossy compression in which each execution flow is reduced to a simplified form comprising a least number of components, to provide compressed execution flows.

30. A computer-implemented method for monitoring an application running at a first computer system, comprising the computer-implemented steps of:

receiving information from probes of instrumented byte code of the application, the information is used to provide a plurality of execution flows at the application, each of the plurality of execution flows comprising;

a sequence which represents start and finish nodes for each component in a transaction, and a calling relationship between the components in the transaction, the plurality of execution flows comprise different sequences of start and finish nodes;

categorizing the plurality of execution flows into a single execution flow shape selected from a plurality of execution flow shapes so that the plurality of execution flows are represented by the single execution flow shape and the different sequences of start and finish nodes are represented by a single sequence of start and finish nodes of the single execution flow shape;

for each of the plurality of execution flows, calculating an execution time based on a first of the start nodes and a last of the finish nodes;

providing slowest and fastest execution times and at least one of a median and a mean execution time of the single execution flow shape based on the calculating; and

reporting from the first computer system to a manager computer system;

(i) the single execution flow shape, and (ii) the slowest and fastest execution times and the at least one of the median and the mean execution time of the single execution flow shape, wherein one execution flow of the plurality of execution flows is provided by performing lossy compression on an uncompressed execution flow to reduce the uncompressed execution flow to a simplified form comprising a reduced number of components, and the one execution flow and the uncompressed execution flow are discarded once the plurality of execution flows have been categorized so that the one execution flow and the uncompressed execution flow are not reported from the first computer system to the manager computer.

31. The computer-implemented method of claim 30, wherein:

for each of the plurality of execution flows, the first of the start nodes indicates a start of the transaction and the last of the finish nodes indicates a finish of the transaction.

32. The computer-implemented method of claim 30, further comprising:

for each of the plurality of execution flows, calculating execution times for the components based on the start and finish nodes which correspond to the single sequence of start and finish nodes of the single execution flow shape; and

providing, and reporting from the first computer system to the manager computer system, slowest and fastest execution times and at least one of a median and a mean execution time of the components based on the calculating execution times for the components.