Method for request profiling in service systems with kernel events

• US 8,875,158 B2
• Filed: 03/26/2013
• Issued: 10/28/2014
• Est. Priority Date: 03/26/2012
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Laboratories America Inc (NEC Corporation)
• Inventors: Zhang, Hui, Rhee, Junghwan, Jiang, Guofei, Yoshihira, Kenji
• Primary Examiner(s): DAO, TUAN C.
• Application Number:
  US13/850,531
• Publication Number:
  US 20140109112A1
• Time in Patent Office: 581 Days
• US Class Current: 719/318
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

A method for request profiling in service systems with kernel events includes collecting kernel events traces from a target system, the kernel event traces being obtainable from individual service machines by instrumenting core kernel functions, analyzing kernel event traces for constructing end-to-end request profiling traces consisting of kernel events belonging to service processes, and categorizing request traces responsive to the analyzing with the constructing including grouping requests based on marking kernel events used in the analyzing.

Claims

1. A method for request profiling in service systems with kernel events, comprising the steps of:

collecting kernel events traces from a target system, said kernel event traces obtainable from individual service machines by instrumenting core kernel functions;

analyzing kernel event traces for constructing end-to-end request profiling traces consisting of kernel events belonging to service processes; and

categorizing request traces responsive to said analyzing step, said constructing including grouping requests based on marking kernel events used in said analyzing step;

wherein said end-to-end request profiling comprises;

generating request units from collected kernel events based on a configurable marking event set; and

constructing full-path request traces by composing relevant requests units based on a causality relationship set which is between request units and defined on the marking event set and temporal relationships,

wherein said step of constructing full-path requests comprises defining a causality relationship set including event association rules each presented as a 5 tuple record;

causing event type, caused event type, time rule, owner rule and event data rule.

2. The method of claim 1, wherein said service processes include one of being distributed over multiple machines, residing on the same machine, and belonging to same processes such as a series of threads executing a single request.

3. The of claim 1, wherein said begin event type comprises defining the event type that the first event of a request unit must exactly match, examples of said begin event type, including but not limited to, are network event types, inter-process communication event types, process event type, system call event types, and application event types.

4. The method of claim 3, wherein said owner filter comprises defining the owner ID that the first and last events of a request unit must partially or exactly match, examples of said owner filter, including but not limited to, are a specific process name, a specific process ID, or a wild card matching any owner ID.

5. The of claim 1, wherein said end event type comprises defining the event type that the last event of a request unit must exactly match, examples of said end event type, including but not limited to, are network event types, inter-process communication event types, system call event types, and application event types.

6. The of claim 1, wherein said event data filter comprises defining the event data that the first and last events of a request unit must partially or exactly match, examples of said event data filter, including but not limited to, are a network event, inter-process communication event data, and application event data, a wild card in these fields matching any event data and the event data filters can be different for the first and last events.

7. The of claim 1, wherein said step of generating request units comprises a request unit slicing process where one request unit is defined through a time ordered event sequence data structure that is an event record subsequence of one process, said request unit slicing comprising:

generating transaction units from per-process kernel event traces;

keeping track of open transaction units and complete transaction units, said open transaction units having beginnings detected but not found in endings yet and complete transaction units having both beginnings and endings detected;

scanning one event after another in a process'"'"'s event sequence;

checking the event with event marks on a begin event type and an end event type;

creating a new open transaction unit if its first beginning event is detected; and

closing an open transaction unit as a complete one when its ending event is detected.

8. The of claim 1, wherein said step of constructing full path requests includes a request unit sequencing procedure comprising for each transaction unit, searching for the transaction units causing it, either in other processes due to certain event-causality rules, or in its own process due to time-causality rules;

and after said searching, constructing a full-path transaction for each transaction unit with no causing transaction unit found;

the transaction being rooted at said transaction unit, and expanded over all transaction units caused by that root in one hop or multiple hops.

9. The method of claim 8, wherein said causing event type comprises defining the type of events that can cause the occurrence of other events, said caused event type comprises defining the type of events that are caused by other events, said time rule comprises defining a rule that a causing event type event and a caused event type event can be associated based on their temporal relationships, said owner rule comprises defining a rule that a causing event type event and a caused event type event can be associated based on their owner IDs;

and said event data rule comprises defining a rule that a causing event type event and a caused event type event can be associated based on their event data.

10. A non-transitory storage medium containing instructions for a computer for carrying out the steps comprising:

collecting kernel events traces from a target system, said kernel event traces obtainable from individual service machines by instrumenting core kernel functions;

analyzing kernel event traces for constructing end-to-end request profiling traces consisting of kernel events belonging to service processes; and

categorizing request traces responsive to said end-to-end request profiling, said constructing including grouping requests based on marking kernel events used in said end-to-end request profiling;

wherein said analyzing comprises;

generating request units from collected kernel events based on a configurable marking event set; and

constructing full-path request traces by composing relevant requests units based on a causality relationship set which is between request units and defined on the marking event set and temporal relationships;

wherein said generating comprises a defined marking event set comprising;

presenting request unit marks as a 4-tuple record;

begin event type, end event type, owner filter and event data filter; and

providing a set of request unit marks used to detect begins and ends of request units in event record sequences, said request unit marks being predefinable as a default set or dynamically configured upon user requests.

11. The non-transitory storage medium of claim 10, wherein said begin event type comprises defining the event type that the first event of a request unit must exactly match, examples of said begin event type, including but not limited to, are network event types, inter-process communication event types, process event type, system call event types, and application event types.

12. The non-transitory storage medium of claim 10, wherein said end event type comprises defining the event type that the last event of a request unit must exactly match, examples of said end event type, including but not limited to, are network event types, inter-process communication event types, system call event types, and application event types.

13. The non-transitory storage medium of claim 10, wherein said owner filter comprises defining the owner ID that the first and last events of a request unit must partially or exactly match, examples of said owner filter, including but not limited to, are a specific process name, a specific process ID, or a wild card matching any owner ID.

14. The non-transitory storage medium of claim 10, wherein said event data filter comprises defining the event data that the first and last events of a request unit must partially or exactly match, examples of said event data filter, including but not limited to, are a network event, inter-process communication event data, and application event data, a wild card in these fields matching any event data and the event data filters can be different for the first and last events.

15. The non-transitory storage medium of claim 10, wherein said step of generating comprises a request unit slicing process where one request unit is defined through a time ordered event sequence data structure that is an event record subsequence of one process, said request unit slicing comprising:

generating transaction units from per-process kernel event traces;

keeping track of open transaction units and complete transaction units, said open transaction units having beginnings detected but not found in endings yet and complete transaction units having both beginnings and endings detected;

scanning one event after another in a process'"'"'s event sequence;

checking the event with event marks on a begin event type and an end event type;

creating a new open transaction unit if its first beginning event is detected; and

closing an open transaction unit as a complete one when its ending event is detected.

16. A method for request profiling in service systems with kernel events, comprising the steps of:

collecting kernel events traces from a target system, said kernel event traces obtainable from individual service machines by instrumenting core kernel functions;

analyzing kernel event traces for constructing end-to-end request profiling traces consisting of kernel events belonging to service processes; and

categorizing request traces responsive to said analyzing step, said constructing including grouping requests based on marking kernel events used in said analyzing step;

wherein said end-to-end request profiling comprises;

generating request units from collected kernel events based on a configurable marking event set; and

constructing full-path request traces by composing relevant requests units based on a causality relationship set which is between request units and defined on the marking event set and temporal relationships.

wherein said step of generating request units comprises;

presenting request unit marks as a 4-tuple record;

begin event type, end event type, owner filter and event data filter; and

providing a set of request unit marks used to detect begins and ends of request units in event record sequences, said request unit marks being predefinable as a default set or dynamically configured upon user requests.