Analyzing servers based on data streams generated by instrumented software executing on the servers
AssigneeSplunk Inc.
InventorsOzan Turgut, Joseph Ari Ross, Eyal Ophir, Calvin Chan
Life of this patent
Estimating the term…
Abstract
An instrumentation analysis system processes data streams received from servers executing instrumented software. The system determines a set of servers that satisfy a given criteria, for example, a set of servers with high resource utilization. The set of servers may be determined by the system based on triggers or specified by a user. The system analyzes properties of servers to determine a property that characterizes the set of servers. The property characterizing the servers is provided to users via a user interface or alerts for further analysis, for example, to analyze the cause of high resource utilization.
Claims20
A method for analyzing servers executing instrumented software, the method comprising:
- identifying a filtered set of servers from a plurality of servers, the filtered set of servers satisfying a filtering criterion;
- selecting a plurality of properties of the filtered set of servers, each property from the plurality of properties comprising at least a name value pair having at least a dimension of servers and a value of the dimension;
- for each property from the selected plurality of properties, determining a score based on a comparison of a likelihood of a server from the filtered set of servers having the property with a likelihood of a server outside the filtered set of servers having the property;
- identifying a characteristic property of the filtered set of servers based on a ranking of the scores, such that servers from the filtered set of servers have a higher likelihood of having the characteristic property than servers outside the filtered set of servers;
- and
- for each property representing a particular value for a particular dimension, ranking properties of servers, the ranking comprising:
- determining a first value of a probability mass function for the particular dimension for servers in the filtered set;
- and
- determining a second value of the probability mass function for the particular dimension for a set of servers comprising one or more servers outside the filtered set.
A system for analyzing servers executing instrumented software, the system comprising:
- at least one memory having instructions stored thereon;
- and
- at least one processor configured to execute the instructions, wherein the at least one processor is configured to:
- identify a filtered set of servers from a plurality of servers, the filtered set of servers satisfying a filtering criterion;
- select a plurality of properties of the filtered set of servers, each property from the plurality of properties comprising at least a name value pair having at least a dimension of servers and a value of the dimension;
- for each property from the selected plurality of properties, determine a score based on a comparison of a likelihood of a server from the filtered set of servers having the property with a likelihood of a server outside the filtered set of servers having the property;
- identify a characteristic property of the filtered set of servers based on a ranking of the scores, such that servers from the filtered set of servers have a higher likelihood of having the characteristic property than servers outside the filtered set of servers;
- and
- for each property representing a particular value for a particular dimension, ranking properties of servers, the ranking comprising:
- determining a first value of a probability mass function for the particular dimension for servers in the filtered set;
- and
- determining a second value of the probability mass function for the particular dimension for a set of servers comprising one or more servers outside the filtered set.
A non-transitory computer-readable storage medium comprising instructions stored thereon, which when executed by one or more processors, cause the one or more processors to perform operations for analyzing servers executing instrumented software, comprising:
- identifying a filtered set of servers from a plurality of servers, the filtered set of servers satisfying a filtering criterion;
- selecting a plurality of properties of the filtered set of servers, each property from the plurality of properties comprising at least a name value pair having at least a dimension of servers and a value of the dimension;
- for each property from the selected plurality of properties, determining a score based on a comparison of a likelihood of a server from the filtered set of servers having the property with a likelihood of a server outside the filtered set of servers having the property;
- identifying a characteristic property of the filtered set of servers based on a ranking of the scores, such that servers from the filtered set of servers have a higher likelihood of having the characteristic property than servers outside the filtered set of servers;
- and
- for each property representing a particular value for a particular dimension, ranking properties of servers, the ranking comprising:
- determining a first value of a probability mass function for the particular dimension for servers in the filtered set;
- and
- determining a second value of the probability mass function for the particular dimension for a set of servers comprising one or more servers outside the filtered set.
Dependencies are inferred from the claim text.