Analysis stack for an event flow

• US 9,542,256 B2
• Filed: 01/22/2015
• Issued: 01/10/2017
• Est. Priority Date: 05/13/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Nano, Olivier, Santos, Ivo Jose Garcia dos, Tarnavski, Tihomir, Peray, Sebastien, Tilly, Marcel, Krishnan, Ramkumar
• Primary Examiner(s): LE, HUNG D
• Application Number:
  US14/603,099
• Publication Number:
  US 20150143177A1
• Time in Patent Office: 719 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

An analysis module is configured to receive data associated with an event flow. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow. The analysis module is configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface.

Claims

1. A system, comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions, that when executed by the processor, cause execution of an event flow analyzer configured to;

receive input indicating a selection of a plurality of analysis modules for incorporation into an ordered set of analysis modules configured for sequential operation on an associated even flow;

wherein a first analysis module of the selected plurality of analysis modules is operable for analyzing the event flow to obtain analysis data, the event flow including a plurality of events, each event including an operator, timing information, and a payload, and

wherein a second analysis module of the selected plurality of analysis modules is operable for analyzing the analysis data output from the first analysis module.

2. The system of claim 1, wherein each of the plurality of analysis modules is independently executable with respect to other analysis modules.

3. The system of claim 1, wherein the input further indicates an ordering of the plurality of analysis modules and wherein each of the plurality of analysis modules is further configured to:

receive data from a previous analysis module based on the ordering; and

transmit data to a subsequent analysis module based on the ordering.

4. The system of claim 1, wherein the timing information includes a start time and a stop time.

5. The system of claim 1, wherein at least one of the operators comprises an insert operator.

6. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute a replay analysis operation to simulate a passage of time at an analysis user interface based on one or more punctuation events.

7. The system of claim 6, wherein the replay analysis operation is further executable to:

show events at an analysis user interface (UI) having event lifetimes that include a particular point in the passage of time; and

hide events at the analysis UI having event lifetimes that do not include the particular point in the passage of time.

8. The system of claim 7, wherein the particular point in the passage of time is user-defined.

9. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute an event propagation analysis operation with respect to a particular event to identify one or more subsequent events at an analysis user interface that are affected by the particular event.

10. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute a root cause analysis operation with respect to a particular event to identify one or more previous events at an analysis user interface that affect the particular event.

11. The system of claim 1, wherein the plurality of analysis modules comprises an analysis module configured to execute a filtering analysis operation to show those events at an analysis user interface that satisfy a filtering criteria.

12. The system of claim 11, wherein the filtering criteria is based on event kinds, event start times, event end times, new event end times, event log times, event latency, event payloads, or any combination thereof.

13. The system of claim 11, wherein the filtering analysis operation is executable with respect to a particular operator of a query.

14. The system of claim 1, wherein the input indicating the selection of the plurality of analysis modules for incorporation into the ordered set of analysis modules further comprises:

receiving input for reordering the plurality of analysis modules.

15. The system of claim 14, wherein the input for reordering the plurality of analysis modules comprises drag and drop input.

16. The system of claim 1, wherein the plurality of analysis modules comprises one or more of:

a replay analysis module configured to execute a replay analysis operation to simulate a passage of time based on one or more punctuation events;

a partition analysis module configured to execute a partitioning analysis operation;

an even propagation analysis module configured to execute an event propagation analysis operation with respect to a particular event to identify one or more subsequent events that are affected by the particular event; and

a root cause analysis module configured to execute a root cause analysis operation with respect to a specific event to identify one or more previous events that affect the specific event.

17. The system of claim 16, wherein the plurality of analysis modules comprises at least two or more of the replay analysis module, the partition analysis module, the event propagation analysis module and the root cause analysis module.

18. A computer-implemented method, comprising:

receiving data representing an event flow, wherein the event flow is associated with a plurality of events, each event including an operator, timing information, and a payload;

executing a first software class configured to;

execute a first analysis operation on at least a portion of the event to generate a first intermediate result; and

output the first intermediate result to a subsequent software class; and

executing a second software class configured to;

receive a second intermediate result from a previous software class;

execute a second analysis operation on the second intermediate result to generate a final result; and

output the final result to an analysis user interface (UI);

wherein the first and second analysis operations are associated with the even flow as at least part of an ordered set of user selected analysis operations configured for sequential operations of analysis performed on the event flow, and such that the final result is based at least in part on the first intermediate result obtained from the first analysis operation.

19. The computer-implemented method of claim 18, further comprising executing one or more additional software classes after executing the first software class and before executing the second software class, wherein the one or more software classes are operable to generate the second intermediate result from the first intermediate result.

20. The computer-implemented method of claim 18, wherein the timing information comprises a start time and an end time.

21. A computer hardware storage device having instructions stored thereon that are operable, when executed by one or more computing processors, to cause a computing system to perform at least the following:

receive analysis data associated with an event flow generated by execution of a query, the event flow including a plurality of events, each event including an operator, timing information, and a payload, wherein the analysis data is received from a first analysis module, and wherein the analysis data is received via a software communication interface;

execute an analysis operation on the analysis data to generate an analysis result, wherein a second analysis module is used to execute the analysis operation which is different than the first analysis module that was previously used to obtain the analysis data; and

output the analysis result to a subsequent analysis module or to a user interface via the software communication interface,

wherein the first and second analysis modules are associated with the event flow as part of an ordered set of user selected analysis modules configured for sequential operations of analysis on the event flow.

22. The computer-readable medium of claim 21, wherein the subsequent analysis module is selectable for inclusion in the ordered set of user selected analysis modules, and wherein the subsequent analysis module is independently executable with respect to the first and second analysis modules in the ordered set of user selected analysis modules.

23. The computer-readable medium of claim 21, wherein the subsequent analysis module is configured to execute a partitioning analysis operation.

24. The computer-readable medium of claim 21, wherein at least one of the operators comprises an insert operator.