System using footprints in system log files for monitoring transaction instances in real-time network

• US 7,908,365 B2
• Filed: 01/25/2008
• Issued: 03/15/2011
• Est. Priority Date: 01/25/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Banerjee, Nilanjan, Kumar, Arun, Sengupta, Bikram
• Primary Examiner(s): LUU, LE HIEN
• Application Number:
  US12/019,710
• Publication Number:
  US 20090193112A1
• Time in Patent Office: 1,145 Days
• Field of Search: 709/223, 709/224, 709/225, 705/67, 705/7, 707/1, 379/144.02, 718/101
• US Class Current: 709/224
• CPC Class Codes: G06F 11/28 by checking the correct order of processing G06F11/08 - G06F11/26 take precedence; monitoring patterns of pulse trains H03K5/19

Abstract

Techniques for monitoring one or more transaction instances in a real-time network are provided. The techniques include obtaining one or more system log files, wherein one or more footprints left by one or more transaction instances are recorded in the one or more system log files, obtaining a transaction model, wherein the transaction model comprises one or more transaction steps and a footprint pattern corresponding with each transaction step, and using the one or more system log files and the transaction model to monitor the one or more transaction instances in a real-time network at least one of an individual level and one or more aggregate levels.

Claims

1. A system for monitoring one or more transaction instances in a real-time network, wherein the system comprises distinct software modules, each of the distinct software modules being embodied on a tangible computer-readable recordable storage medium, and wherein the distinct software modules comprise:

a probe manager executing on a hardware processor, wherein the probe manager sorts one or more records sent by one or more probes in real-time according to one or more corresponding timestamps to create a sorted log record sequence;

an engine executing on a hardware processor, wherein the engine receives the log record sequence from the probe manager, determines if the log record sequence matches a footprint pattern of a state in a transaction model and creates an output; and

an agent pool executing on a hardware processor, wherein the agent pool comprises a set of agents that process an output from the engine and monitor one or more states of an associated transaction instance as the instance executes.

2. The system of claim 1, wherein if the log record sequence matches the footprint pattern of an initial state of the transaction model, the engine indicates a start of a new transaction instance and creates a new agent to monitor the new transaction instance.

3. The system of claim 1, wherein if the log record sequence does not match the footprint pattern of an initial state, but matches a footprint of a different state in the transaction model, the engine determines a set of candidate transaction instances that may have generated the log record sequence.

4. The system of claim 1, wherein the set of agents are distributed over two or more machines and process an input in parallel.

5. The system of claim 1, wherein each agent maintains execution history data for the associated transaction instance over one or more transaction model states and determines one or more possible states of the transaction instance and a probability of the transaction instance being at each state.

6. The system of claim 1, wherein if the log record sequence matches the footprint pattern of a state in the transaction model, the engine increments by one a minimum and maximum possible number of transaction instances at that state in the transaction model, and re-computes a minimum and maximum possible number of transaction instances at one or more other states in the transaction model.

7. The system of claim 1, wherein one or more theoretical bounds on a number of transaction instances at any state of the transaction model are developed.

8. A computer program product comprising a tangible computer readable recordable storage medium having computer useable program code for monitoring one or more transaction instances in a real-time network, said computer program product including:

computer useable program code for obtaining one or more system log files, wherein one or more footprints left by one or more transaction instances are recorded in the one or more system log files;

computer useable program code for obtaining a transaction model, wherein the transaction model comprises one or more transaction steps and a footprint pattern corresponding with each transaction step; and

computer useable program code for using the one or more system log files and the transaction model to monitor the one or more transaction instances in a real-time network at least one of an individual level and one or more aggregate levels.

9. The computer program product of claim 8, wherein the computer useable program code for using the one or more system log files and the transaction model to monitor the one or more transaction instances at an individual level comprises computer useable program code for determining a set of one or more possible states of each transaction instance and a probability of each instance being at each of the one or more possible states.

10. The computer program product of claim 8, wherein the computer useable program code for using the one or more system log files and the transaction model to monitor the one or more transaction instances at one or more aggregate levels comprises computer useable program code for determining one or more limits on a number of transaction instances at a given state of a transaction model.

11. The computer program product of claim 8, wherein the footprint pattern comprises at least one of a representation of complete path information and a regular expression involving at least one of constants, variable words with associated types, and arbitrary strings.

12. A system for monitoring one or more transaction instances in a real-time network, comprising:

a memory; and

at least one processor coupled to said memory and operative to;

obtain one or more system log files, wherein one or more footprints left by one or more transaction instances are recorded in the one or more system log files;

obtain a transaction model, wherein the transaction model comprises one or more transaction steps and a footprint pattern corresponding with each transaction step; and

use the one or more system log files and the transaction model to monitor the one or more transaction instances in a real-time network at least one of an individual level and one or more aggregate levels.

13. The system of claim 12, wherein the at least one processor coupled to said memory and operative to use the one or more system log files and the transaction model to monitor the one or more transaction instances at an individual level is further operative to determine a set of one or more possible states of each transaction instance and a probability of each instance being at each of the one or more possible states.

14. The system of claim 12, wherein the at least one processor coupled to said memory and operative to use the one or more system log files and the transaction model to monitor the one or more transaction instances at one or more aggregate levels is further operative to determine one or more limits on a number of transaction instances at a given state of a transaction model.

15. The system of claim 12, wherein in the footprint pattern comprises at least one of a representation of complete path information and a regular expression involving at least one of constants, variable words with associated types, and arbitrary strings.