System and method for determining relevant computer performance events
View Patent ↗In one embodiment, a method includes identifying at least one transaction-path node as a problem node based, at least in part, on an analysis of end-to-end response times for a group of transactions. The method further includes determining one or more event types for the at least one transaction-path node. Also, the method includes, for each of the one or more event types, inferring a first event-relevance weight from an abstract model. The method also includes, for each of the one or more event types, inferring a second event-relevance weight from a concrete model. Furthermore, the method includes, for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight. Additionally, the method includes identifying most-relevant events among a set of active events based, at least in part, on the determined event relevance.
1. A method comprising, by a computer system:
monitoring, in real-time, end-user transactions that pass through an end-to-end transaction path comprising a plurality of transaction-path nodes;
responsive to the monitoring, identifying at least one transaction-path node of the plurality of transaction-path nodes as a problem node based, at least in part, on an analysis of end-to-end response times for a group of the monitored end-user transactions;
determining one or more event types that are related to the at least one transaction-path node based, at least in part, on the one or more event types being at least indirectly connected to the at least one transaction-path node in at least one of an abstract model and a concrete model;
wherein the abstract model comprises a first probabilistic graphical model that represents a set of monitored-resource types, a plurality of event types, and a probabilistic relevance of the monitored-resource types to the plurality of event types, the set of monitored-resource types comprising a monitored-resource type of the at least one transaction-path node, the plurality of event types comprising the one or more event types;
wherein the concrete model comprises a second probabilistic graphical model that represents a real-time topology of monitored resources, the plurality of event types, and a probabilistic relevance of the monitored resources to the plurality of event types such that the monitored resources are instances of the monitored-resource types, the monitored resources comprising the at least one transaction path node;
for each of the one or more event types, inferring a first event-relevance weight from the abstract model;
for each of the one or more event types, inferring a second event-relevance weight from the concrete model;
for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight;
identifying a set of currently-firing events that correspond to one or more of the one or more event types;
identifying most-relevant events among the set of currently-firing events based, at least in part, on the determined event relevance; and
publishing the identified most-relevant events to a user to facilitate troubleshooting of the problem node.
2. The method of claim 1 , wherein the identifying of the at least one transaction-path node comprises calculating a response-time differential between an execution time by the at least one transaction-path node in deemed unacceptable transactions and an execution time by the at least one transaction-path node in deemed acceptable transactions.
3. The method of claim 2 , comprising:
determining a base relevance value for the at least one transaction-path node;
and wherein the determining of the event relevance is based, at least in part, the base relevance value.
4. The method of claim 3 , wherein the base relevance value comprises a normalization of the response-time differential.
5. The method of claim 1 , comprising selecting the group of transactions, the group having a common end-to-end transaction path comprising a plurality of transaction-path nodes, the plurality of transaction-path nodes comprising the at least one transaction-path node.
6. The method of claim 1 , comprising transmitting a report to another system for analysis.
7. The method of claim 1 , wherein the abstract model and the concrete model each comprise a Bayesian network.
8. The method of claim 1 , comprising deferring evaluation of one or more rules associated with at least one event until the at least one event is determined sufficiently relevant as a result of the determining of the event relevance.
9. The method of claim 1 , comprising training the abstract model and the concrete model using a result of the determining of the event relevance.
10. An information handling system comprising:
a processor and memory, wherein the processor and memory in combination are operable to implement a method comprising:
monitoring, in real-time, end-user transactions that pass through an end-to-end transaction path comprising a plurality of transaction-path nodes;
responsive to the monitoring, identifying at least one transaction-path node of the plurality of transaction-path nodes as a problem node based, at least in part, on an analysis of end-to-end response times for a group of the monitored end-user transactions;
determining one or more event types that are related to the at least one transaction-path node based, at least in part, on the one or more event types being at least indirectly connected to the at least one transaction-path node in at least one of an abstract model and a concrete model;
wherein the abstract model comprises a first probabilistic graphical model that represents a set of monitored-resource types, a plurality of event types, and a probabilistic relevance of the monitored-resource types to the plurality of event types, the set of monitored-resource types comprising a monitored-resource type of the at least one transaction-path node, the plurality of event types comprising the one or more event types;
wherein the concrete model comprises a second probabilistic graphical model that represents a real-time topology of monitored resources, a plurality of event types, and a probabilistic relevance of the monitored resources to the plurality of event types such that the monitored resources are instances of the monitored-resource types, the monitored resources comprising the at least one transaction path node;
for each of the one or more event types, inferring a first event-relevance weight from the abstract model;
for each of the one or more event types, inferring a second event-relevance weight from the concrete model;
for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight;
identifying a set of currently-firing events that correspond to one or more of the one or more event types;
identifying most-relevant events among the set of currently-firing events based, at least in part, on the determined event relevance; and
publishing the identified most-relevant events to a user to facilitate troubleshooting of the problem node.
11. The information handling system of claim 10 , wherein the identifying of the at least one transaction-path node comprises calculating a response-time differential between an execution time by the at least one transaction-path node in deemed unacceptable transactions and an execution time by the at least one transaction-path node in deemed acceptable transactions.
12. The information handling system of claim 11 , the method comprising:
determining a base relevance value for the at least one transaction-path node;
and wherein the determining of the event relevance is based, at least in part, the base relevance value.
13. The information handling system of claim 12 , wherein the base relevance value comprises a normalization of the response-time differential.
14. The information handling system of claim 10 , the method comprising selecting the group of transactions, the group having a common end-to-end transaction path comprising a plurality of transaction-path nodes, the plurality of transaction-path nodes comprising the at least one transaction-path node.
15. The information handling system of claim 10 , the method comprising transmitting a report to another system for analysis.
16. The information handling system of claim 10 , wherein the abstract model and the concrete model each comprise a Bayesian network.
17. The information handling system of claim 10 , the method comprising deferring evaluation of one or more rules associated with at least one event until the at least one event is determined sufficiently relevant as a result of the determining of the event relevance.
18. The information handling system of claim 10 , the method comprising training the abstract model and the concrete model using a result of the determining of the event relevance.
19. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed by a processor to implement a method comprising:
monitoring, in real-time, end-user transactions that pass through an end-to-end transaction path comprising a plurality of transaction-path nodes;
responsive to the monitoring, identifying at least one transaction-path node of the plurality of transaction-path nodes as a problem node based, at least in part, on an analysis of end-to-end response times for a group of the monitored end-user transactions;
determining one or more event types that are related to the at least one transaction-path node based, at least in part, on the one or more event types being at least indirectly connected to the at least one transaction-path node in at least one of an abstract model and a concrete model;
wherein the abstract model comprises a first probabilistic graphical model that represents a set of monitored-resource types, a plurality of event types, and a probabilistic relevance of the monitored-resource types to the plurality of event types, the set of monitored-resource types comprising a monitored-resource type of the at least one transaction-path node, the plurality of event types comprising the one or more event types;
wherein the concrete model comprises a second probabilistic graphical model that represents a real-time topology of monitored resources, a plurality of event types, and a probabilistic relevance of the monitored resources to the plurality of event types such that the monitored resources are instances of the monitored-resource types, the monitored resources comprising the at least one transaction path node;
for each of the one or more event types, inferring a first event-relevance weight from the abstract model;
for each of the one or more event types, inferring a second event-relevance weight from the concrete model;
for each of the one or more event types, determining an event relevance based, at least in part, on the first event-relevance weight and the second event-relevance weight;
identifying a set of currently-firing events that correspond to one or more of the one or more event types;
identifying most-relevant events among the set of currently-firing events based, at least in part, on the determined event relevance; and
publishing the identified most-relevant events to a user to facilitate troubleshooting of the problem node.
20. The computer-program product of claim 19 , wherein the identifying of the at least one transaction-path node comprises calculating a response-time differential between an execution time by the at least one transaction-path node in deemed unacceptable transactions and an execution time by the at least one transaction-path node in deemed acceptable transactions.