Proactive monitoring tree with severity state sorting

• US 9,426,045 B2
• Filed: 07/29/2015
• Issued: 08/23/2016
• Est. Priority Date: 04/30/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Fletcher, Tristan, Noel, Cary Glen
• Primary Examiner(s): An, Meng
• Assistant Examiner(s): Lee, James J
• Application Number:
  US14/812,948
• Publication Number:
  US 20150333987A1
• Time in Patent Office: 391 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 2201/815 Virtual middleware or OS functionality using virtual machines to implement generic software techniques for error detection or fault masking G06F11/1484
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

The disclosed embodiments relate to a system that displays performance data for a computing environment. During operation, the system first determines values for a performance metric for entities that comprise the computing environment. Next, the system displays the computing environment as a tree comprising nodes representing the entities and edges representing parent-child relationships between the entities. While displaying the tree, the system displays the child nodes for each parent in sorted order based on values of the performance metric associated with the child nodes.

Claims

1. A computer-implemented method for displaying performance data for a computing environment, the method comprising:

determining values for a performance metric for entities that comprise the computing environment; and

displaying the computing environment as a tree comprising nodes representing the entities and edges representing parent-child relationships between the entities;

wherein while displaying each leaf node in the tree, the method comprises;

comparing the values of the performance metric against one or more state-specific threshold values to determine a performance state for the leaf node; and

displaying the leaf node as a first shape comprising an indicator for the performance state for the leaf node;

wherein while displaying each parent node in the tree, the method comprises;

determining a performance state of the parent node based on a worst performance state of any child node under the parent node;

displaying the parent node as second shape comprising an indicator of the performance state of the parent node; and

wherein while displaying a set of child nodes for each parent node, the method comprises;

determining a performance state for each child node in the set based on a value of the performance metric for an entity associated with the child node, wherein a set of possible performance states vary in severity;

wherein if a child node in the set has descendants in the tree, the performance state for the child node includes count of performance states for the descendants of the child node, and

determining a sorted order for the set of child nodes based on counts of descendants of the child nodes having a most-severe performance state; and

displaying the set of child nodes in the sorted order.

2. The computer-implemented method of claim 1, where displaying the parent node comprises displaying an outer ring surrounding an inner circular shape, wherein the outer ring comprises visually distinct sections associated with performance states of leaf nodes under the parent node, wherein the sections are sized proportionately with the counts of the performance states for the leaf nodes under the parent node.

3. The computer-implemented method of claim 1, wherein determining the values for a selected performance metric includes:

receiving, from a user, a selection of the performance metric from a set of monitored performance metrics; and

obtaining the values for the selected performance metric for the entities from the performance data for the computing environment.

4. The computer-implemented method of claim 1, wherein the set of possible performance states includes:

a critical state, a warning state, a normal state, and an unknown state.

5. The computer-implemented method of claim 1, wherein the entity includes:

a virtual machine;

a host system that executes one or more virtual machines;

a cluster comprising one or more host systems;

or

a virtual center comprising one or more clusters.

6. The computer-implemented method of claim 1, wherein the performance metric relates to one or more of:

central-processing unit (CPU) utilization;

memory utilization;

disk utilization;

network utilization; and

power consumption.

7. The computer-implemented method of claim 1, wherein the performance metric is measured over a specific time interval.

8. The computer-implemented method of claim 1, wherein the first shape is the same as the second shape.

9. The computer-implemented method of claim 1, wherein determining the values for the performance metric includes obtaining the values from a set of events containing raw data associated with a time stamp.

10. The computer-implemented method of claim 1, wherein determining the values for the performance metric includes:

receiving a query to be processed; and

using one or more extraction rules generated from the query to obtain the values from a set of time-stamped events containing raw data.

11. The computer-implemented method of claim 1, wherein determining the values for the performance metric includes:

receiving a query to be processed; and

using one or more extraction rules to obtain the values from a set of time-stamped events containing raw data.

12. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for displaying performance data for a computing environment, the method comprising:

determining values for a performance metric for entities that comprise the computing environment; and

displaying the computing environment as a tree comprising nodes representing the entities and edges representing parent-child relationships between the entities;

wherein while displaying each leaf node in the tree, the method comprises;

comparing the values of the performance metric against one or more state-specific threshold values to determine a performance state for the leaf node; and

displaying the leaf node as a first shape comprising an indicator for the performance state for the leaf node;

wherein while displaying each parent node in the tree, the method comprises;

determining a performance state of the parent node based on a worst performance state of any child node under the parent node;

displaying the parent node as a second shape comprising an indicator of the performance state of the parent node; and

wherein while displaying a set of child nodes for each parent node, the method comprises;

determining a performance state for each child node in the set based on a value of the performance metric for an entity associated with the child node, wherein a set of possible performance states vary in severity;

wherein if a child node in the set has descendants in the tree, the performance state for the child node includes count of performance states for the descendants of the child node, and

determining a sorted order for the set of child nodes based on counts of descendants of the child nodes having a most-severe performance state; and

displaying the set of child nodes in the sorted order.

13. The non-transitory computer-readable storage medium of claim 12, where displaying the parent node comprises displaying an outer ring surrounding an inner circular shape, wherein the outer ring comprises visually distinct sections associated with performance states of leaf nodes under the parent node, wherein the sections are sized proportionately with the counts of the performance states for the leaf nodes under the parent node.

14. The non-transitory computer-readable storage medium of claim 12, wherein determining the values for a selected performance metric includes:

receiving, from a user, a selection of the performance metric from a set of monitored performance metrics; and

obtaining the values for the selected performance metric for the entities from the performance data for the computing environment.

15. The non-transitory computer-readable storage medium of claim 12, wherein the set of possible performance states includes:

a critical state, a warning state, a normal state, and an unknown state.

16. The non-transitory computer-readable storage medium of claim 12, wherein the first shape is the same as the second shape.

17. The non-transitory computer-readable storage medium of claim 12, wherein determining the values for the performance metric includes obtaining the values from a set of events containing raw data associated with a time stamp.

18. The non-transitory computer-readable storage medium of claim 12, wherein determining the values for the performance metric includes:

receiving a query to be processed; and

using one or more extraction rules generated from the query to obtain the values from a set of time-stamped events containing raw data.

19. The non-transitory computer-readable storage medium of claim 12, wherein determining the values for the performance metric includes:

receiving a query to be processed; and

using one or more extraction rules to obtain the values from a set of time-stamped events containing raw data.

20. A system that displays performance data for a computing environment, the system comprising:

a computing cluster comprising a plurality of processors and associated memories; and

a performance-monitoring mechanism that executes on the computing cluster and;

determines values for a performance metric for entities that comprise the computing environment; and

displays the computing environment as a tree comprising nodes representing the entities and edges representing parent-child relationships between the entities;

wherein for each leaf node in the tree, the performance-monitoring mechanism;

compares the values of the performance metric against one or more state-specific threshold values to determine performance state for the leaf node; and

displays the leaf node as a first shape comprising an indicator for the performance state for the leaf node;

wherein for each parent node in the tree, the performance-monitoring mechanism;

determines a performance state of the parent node based on a worst performance state of any child node under the parent node;

displays the parent node as second shape comprising an indicator of the performance state of the parent node; and

wherein while displaying a set of child nodes for each parent node, the performance monitoring mechanism;

determines a performance state for each child node in the set based on a value of the performance metric for an entity associated with the child node, wherein a set of possible performance states vary in severity;

wherein if a child node in the set has descendants in the tree, the performance state for the child node includes count of performance states for the descendants of the child node, and

determines a sorted order for the set of child nodes based on counts of descendants of the child nodes having a most-severe performance state, and

displays the set of child nodes in the sorted order.

21. The system of claim 20, where displaying the parent node comprises displaying an outer ring surrounding an inner circular shape, wherein the outer ring comprises visually distinct sections associated with performance states of leaf nodes under the parent node, wherein the sections are sized proportionately with the counts of the performance states for the leaf nodes under the parent node.

22. The system of claim 20, wherein while determining the values for a selected performance metric, the performance-monitoring mechanism is configured to:

receive, from a user, a selection of the performance metric from a set of monitored performance metrics; and

obtain the values for the selected performance metric for the entities from the performance data for the computing environment.

23. The system of claim 20, wherein the set of possible performance states includes:

a critical state, a warning state, a normal state, and an unknown state.

24. The system of claim 20, wherein the first shape is the same as the second shape.

25. The system of claim 20, wherein while determining the values for the performance metric, the performance-monitoring mechanism obtains the values from a set of events containing raw data associated with a time stamp.

26. The system of claim 20, wherein determining the values for the performance metric, the performance-monitoring mechanism:

receives a query to be processed; and

uses one or more extraction rules generated from the query to obtain the values from a set of time-stamped events containing raw data.

27. The system of claim 20, wherein determining the values for the performance metric, the performance-monitoring mechanism:

receives a query to be processed; and

uses one or more extraction rules to obtain the values from a set of time-stamped events containing raw data.