Performance anomaly diagnosis

• US 9,904,584 B2
• Filed: 04/15/2015
• Issued: 02/27/2018
• Est. Priority Date: 11/26/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Konig, Arnd Christian, Dvorkin, Igor, Kumar, Manish, Roy, Sudip
• Primary Examiner(s): Manoskey, Joseph D
• Application Number:
  US14/687,848
• Publication Number:
  US 20160147585A1
• Time in Patent Office: 1,049 Days
• Field of Search: 714 46, 714 26, 714 37, 714 471, 714 473, 714 57
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3419 by assessing time
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 16/20 of structured data, e.g. relational data
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

The described implementations relate to tunable predicate discovery. One implementation is manifest as a method for obtaining a data set and determining anomaly scores for anomalies of an attribute of interest in the data set. The method can also generate a ranked list of predicates based on the anomaly scores and cause at least one of the predicates of the ranked list to be presented.

Claims

1. A method implemented by one or more processing devices, the method comprising:

obtaining a data set for one or more data centers;

receiving a diagnostic level selection from a user, the diagnostic level selection being used to tune a magnitude of performance anomalies in the data set to an amount of computational resources allotted to identifying the performance anomalies;

using the allotted amount of the computational resources, identifying the performance anomalies in the data set that have anomaly scores within the diagnostic level selection;

determining predicates for the identified performance anomalies;

generating a ranked list of the predicates based at least in part on the anomaly scores; and

causing at least one of the predicates of the ranked list to be presented.

2. The method of claim 1, further comprising tuning the magnitude of the performance anomalies by:

in a first instance, allotting relatively more computational resources to find relatively smaller performance anomalies in accordance with a first diagnostic level selection; and

in a second instance, allotting relatively fewer computational resources to find relatively larger performance anomalies in accordance with a second diagnostic level selection.

3. The method of claim 1, wherein the performance anomalies relate to latency in the one or more data centers.

4. The method of claim 1, wherein the ranked list includes an indication of the anomaly scores.

5. The method of claim 1, wherein the causing includes displaying the at least one of the predicates on a graphical user interface.

6. A system comprising:

a processing device; and

a storage device storing computer-executable instructions which, when executed by the processing device, cause the processing device to;

receive a data set;

determine an available amount of computational resources to perform anomalous latency identification on the data set;

based at least in part on the available amount of computational resources, select a particular latency magnitude to use for the anomalous latency identification;

using the available amount of computational resources, identify anomalous latencies in the data set based at least in part on changes in distribution of values of multiple attributes of interest associated with the data set, the identified anomalous latencies exhibiting the particular latency magnitude;

generate predicates for the identified anomalous latencies, the predicates being conditions under which the identified anomalous latencies occur; and

cause one or more of the predicates to be presented.

7. The system of claim 6, wherein the predicates include at least one of a hardware misconfiguration, a software failure, a protocol error, or an environmental issue.

8. The system of claim 6, wherein the computer-executable instructions further cause the processing device to:

determine a number of the multiple attributes of interest based at least in part on user input.

9. The system of claim 6, wherein the at least one of the identified anomalous latencies relates to a rate of requests for deployment of virtual machines by a cloud service provider.

10. The system of claim 6, wherein the computer-executable instructions further cause the processing device to:

determine anomaly scores for the identified anomalous latencies; and

generate a ranked list of the predicates using the anomaly scores.

11. The system of claim 10, wherein an individual anomaly score indicates a respective magnitude of an individual identified anomalous latency.

12. The system of claim 6, wherein the computer-executable instructions further cause the processing device to:

select the particular latency magnitude based at least in part on user input.

13. The system of claim 6, wherein at least one of the multiple attributes of interest is associated with a cloud service hardware component.

14. The system of claim 6, wherein at least one of the attributes of interest is specified through user input.

15. The system of claim 6, wherein at least one of the attributes of interest is associated with a data center performance characteristic.

16. The system of claim 6, wherein the computer-executable instructions further cause the processing device to:

generate a graphical user interface (GUI) that displays a graphic of an individual identified anomalous latency relative to a baseline and at least one associated predicate.

17. The system of claim 6, wherein the data set is derived from service logs describing performance of one or more data centers.

18. A system comprising:

a processing device; and

a storage device storing computer-executable instructions which, when executed by the processing device, cause the processing device to;

obtain a data set;

based at least on a diagnostic level selection, determine a magnitude of anomalies of an attribute of interest in the data set to be identified;

identify the anomalies of the attribute of interest using an amount of computational resources specified by the diagnostic level selection;

determine anomaly scores for the anomalies of the attribute of interest;

generate a ranked list of predicates based at least in part on the anomaly scores; and

cause at least one of the predicates of the ranked list to be presented.

19. The system of claim 18, wherein the at least one of the predicates is a condition under which at least one of the anomalies occurred.

20. The system of claim 18, wherein the computer-executable instructions further cause the processing device to:

select the amount of the computational resources to use for identifying the anomalies based at least on the magnitude of the anomalies to be identified.