Analyzing servers based on data streams generated by instrumented software executing on the servers

1. A method for analyzing servers executing instrumented software, the method comprising:

receiving a plurality of input data streams from a plurality of servers, each data stream generated by instrumented software executing on a server from the plurality of servers;

storing attributes of each of the plurality of servers, each attribute associated with a dimension describing the servers, wherein each attribute value for a server is determined based on one of: data received as a data stream from the server or metadata describing the server specified independent of the data streams;

receiving a filtering criterion based on an attribute representing resource utilization of servers;

identifying a filtered set of servers from the plurality of servers, the filtered set of servers satisfying the filtering criterion;

selecting a plurality of properties of the filtered set of servers, each property from the plurality of properties representing a name value pair comprising a dimension of servers and a value of the dimension;

for each property from the selected plurality of properties, determining a score based on a comparison of a likelihood of a server from the filtered set of servers having the property with a likelihood of a server outside the filtered set of servers having the property;

ranking the selected plurality of properties based on the scores, wherein the highest ranked property is the property that has the highest frequency of occurrence in the filtered set of servers reporting data for a selected dimension;

identifying a characteristic property of the filtered set of servers based on the ranking, such that servers from the filtered set of servers have a higher likelihood of having the characteristic property than servers outside the filtered set of servers;

generating an alert describing the characteristic property; and

sending the generated alert to a user account associated with at least one server of the plurality of servers.

2. The method of claim 1 , wherein ranking properties of servers comprises, for a property representing a particular value for a particular dimension:

determining a first value of a probability mass function for the particular dimension for servers in the filtered set;

determining a second value of the probability mass function for the particular dimension for a set of servers comprising one or more servers outside the filtered set; and

determining a score for the property as a function of the first value of the probability mass function and the second value of the probability mass function.

3. The method of claim 2 , wherein the score for the property is a

difference of the first value of the probability mass function and the second value of the probability mass function.

4. The method of claim 2 , wherein the score for the property is a ratio of the first value of the probability mass function and the second value of the probability mass function.

5. The method of claim 1 , wherein the selected plurality of properties represents values of attributes based on metadata describing servers, the metadata specified independent of the data streams.

6. The method of claim 5 , wherein the filtering criterion determines whether the attribute representing resource utilization of servers has a value within a specified set of values.

7. The method of claim 1 , wherein the resource utilization represents one of: CPU utilization, memory utilization, disk utilization, or network utilization.

8. A method for analysis of servers executing instrumented software, the method comprising:

receiving a plurality of input data streams from a plurality of servers, each data stream generated by instrumented software executing on a server from the plurality of servers;

associating each of the plurality of servers with properties, each property specifying a value for a dimension describing the server, wherein each dimension represents one of: data received as a data stream from the server or metadata describing the server specified independent of the data streams;

configuring for presentation, a user interface comprising a graphical representation of the plurality of servers, the graphical representation including a plurality of axes, each axis representing a dimension;

receiving a selection of a dimension via the user interface;

receiving a selection of a set of values of the selected dimension, the set of values representing a filtering criterion;

determining a filtered set of servers from the plurality of servers based on the filtering criterion;

determining a property of the filtered set of servers that from the remaining servers, the determining of the characteristic property of the filtered set of servers comprising:

selecting a plurality of properties of the filtered set of servers, each property from the plurality of properties representing a name value pair comprising a dimension of servers and a value of the dimension;

for each property from the selected plurality of properties, determining a score based on a comparison of a likelihood of a server from the filtered set of servers having the property with a likelihood of a server outside the filtered set of servers having the property;

ranking the selected plurality of properties based on the scores, wherein the highest ranked property is the property that has the highest frequency of occurrence in the filtered set of servers reporting data for a selected dimension;

identifying a characteristic property of the filtered set of servers based on the ranking, the characteristic property having a higher likelihood that servers from the filtered set of servers have the characteristic property than servers outside the filtered set of servers; and

displaying the characteristic property via the user interface as a characteristic of at least one server of the set of servers.

9. The method of claim 8 , wherein the first dimension is a metric representing resource utilization of a server and the filtering criteria evaluates to true for servers having the resource utilization exceeding a threshold value.

10. The method of claim 9 , wherein the resource utilization represents one of: CPU utilization, memory utilization, disk utilization, or network utilization.

11. The method of claim 8 , further comprising:

determining a plurality of clusters of servers, each cluster associated with a range of values of a dimension; and

wherein the filtering criteria identifies a cluster from the plurality of clusters.

12. The method of claim 11 , wherein the filtering criteria identifies a cluster of servers representing outliers having values more than a threshold away from a mean value of the dimension.

13. The method of claim 8 , wherein the selected plurality of properties represents values of attributes based on metadata describing servers, the metadata specified independent of the data streams.

14. The method of claim 8 , wherein the filtering criterion determines whether the attribute representing resource utilization of servers has a value within a specified set of values.

15. The method of claim 8 , wherein receiving the filtering criteria comprises:

receiving a selection of a dimension;

receiving a selection of a set of values of the selected dimension; generating a condition evaluating to true for servers having a value of the dimension in the set of values; and determining the filtering criteria based on the generated condition.

16. The method of claim 8 , wherein ranking properties of servers comprises, for a dimension:

determining a probability mass function for the dimension for servers in the subset;

determining the probability mass function for the dimension for remaining servers outside the subset; and

determining a score for a property representing a value of the dimension as a value proportionate to a difference in the probability of occurrence of the value for servers in the subset compared to the probability of occurrence of the value for remaining servers.

17. The method of claim 8 , further comprising:

generating an alert describing the identified property; and

sending the generated alert to a user account associated with the plurality of servers.

18. A computer-implemented system for processing data generated by instrumented software, the system comprising:

a computer processor; and

a computer readable non-transitory storage medium storing instructions thereon, the instructions when executed by a processor cause the processor to perform the steps of:

receiving a plurality of input data streams from a plurality of servers, each data stream generated by instrumented software executing on a server from the plurality of servers;

storing attributes of each of the plurality of servers, each attribute associated with a dimension describing the servers, wherein each attribute value for a server is determined based on one of: data received as a data stream from the server or metadata describing the server specified independent of the data streams;

receiving a filtering criterion based on an attribute representing resource utilization of servers;

identifying a filtered set of servers from the plurality of servers, the filtered set of servers satisfying the filtering criterion;

selecting a plurality of properties of the filtered set of servers, each property from the plurality of properties representing a name value pair comprising a dimension of servers and a value of the dimension;

for each property from the selected plurality of properties, determining a score based on a comparison of a likelihood of a server from the filtered set of servers having the property with a likelihood of a server outside the filtered set of servers having the property;

ranking the selected plurality of properties based on the scores, wherein the highest ranked property is the property that has the highest frequency of occurrence in the filtered set of servers reporting data for a selected dimension;

identifying a characteristic property of the filtered set of servers based on the ranking, such that servers from the filtered set of servers have a higher likelihood of having the characteristic property than servers outside the filtered set of servers;

generating an alert describing the characteristic property; and

sending the generated alert to a user account associated with at least one server of the plurality of servers.

19. The system of claim 18 , wherein the selected plurality of properties represents values of attributes based on metadata describing servers, the metadata specified independent of the data streams, wherein the filtering criterion determines whether the attribute representing resource utilization of servers has a value within a specified set of values.

20. The system of claim 18 , wherein ranking properties of servers comprises, for a property representing a particular value for a particular dimension:

determining a first value of a probability mass function for the particular dimension for servers in the filtered set;

determining a second value of the probability mass function for the particular dimension for a set of servers comprising one or more servers outside the filtered set; and determining a score for the property as a function of the first value of the probability mass function and the second value of the probability mass function.