Correlating log data with performance measurements using a threshold value
The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.
1. A computer-implemented method comprising:
acquiring, by a computer system, performance measurements for at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment;
acquiring, by the computer system, log data representing activity of at least one hardware or software component of the IT environment;
comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value;
correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation criterion; and
causing display, via a graphical user interface, of an indication of the correlation of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data.
2. A method as recited in claim 1 , further comprising:
causing display of the portion of the log data and the at least one of the performance measurements.
3. A method as recited in claim 1 , further comprising:
causing concurrent display of the portion of the log data and the at least one of the performance measurements.
4. A method as recited in claim 1 , further comprising:
causing concurrent display of a listing of raw log data from the portion of the log data and the at least one of the performance measurements.
5. A method as recited in claim 1 , wherein said correlating is based on a user-specified correlation criterion.
6. A method as recited in claim 1 , wherein said correlating is based on a user-specified correlation criterion that is not a time-based criterion.
7. A method as recited in claim 1 , wherein said correlating is based on a user-specified correlation criterion that relates to a machine in the IT environment.
8. A method as recited in claim 1 further comprising:
obtaining the correlation criterion from a user input to a graphical user interface element that enables a user to input a search criterion as said correlation criterion but does not enable input of a complete search query.
9. A method as recited in claim 1 further comprising:
obtaining the correlation criterion from a user's selection from a drop-down list in a graphical user interface.
10. A method as recited in claim 1 , wherein said correlating is based on the correlation criterion that relates to a machine in the IT environment and is specified by a user's selection from a drop-down list of machines included in the IT environment.
11. A method as recited in claim 1 further comprising, prior to said correlating:
obtaining the correlation criterion from a search query input by a user into a query box in a text-based search query language.
12. A method as recited in claim 1 further comprising:
storing each of the acquired performance measurements and each of the acquired log data with a time-stamp in a time-series data store,
wherein said correlating further comprises identifying the portion of the log data and the at least one of the performance measurements that have time stamps that satisfy a user-specified time criterion.
13. A method as recited in claim 1 , wherein the performance measurements have been determined by direct measurement of a hardware or software component in the IT environment.
14. A method as recited in claim 1 , wherein the log data are derived from a text-based log file.
15. A method as recited in claim 1 , wherein the performance measurements are not derived from a log file and are acquired independently of the log data.
16. A method as recited in claim 1 , wherein the performance measurements are acquired independently of the log data, and wherein the performance measurements have been determined by direct measurement of a hardware or software component in the IT environment and the log data are derived from a text-based log file.
17. A method as recited in claim 1 , wherein the performance measurements are acquired independently of the log data by direct measurement of a hardware or software component in the IT environment, and the log data are acquired independently of the performance measurements.
18. A method as recited in claim 1 , wherein acquiring the performance measurements comprises acquiring, via an application programming interface (API), the performance measurements from a third-party software application that collects the performance measurements.
19. A method as recited in claim 1 , wherein the performance measurements are stored in a first time-series data store, and the log data are stored in a second time-series data store separate from the first time-series data store.
20. A method as recited in claim 1 , wherein the performance measurements are stored in a time-series data store in a first format, and the log data are stored in said time-series data store in a second format different from the first format.
21. A method as recited in claim 1 , wherein the performance measurements are stored in a first time-series data store in a first format, and the log data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format.
22. A method as recited in claim 1 , wherein the performance measurements are stored in a first time-series data store in a first format, and the log data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format;
the method further comprising:
receiving a user-specified search query in a query language for searching the first and second time-series data stores, the user-specified search query containing the correlation criterion;
wherein said correlating further includes, in response to the user-specified search query, searching the first time-series data store for performance data that satisfy the correlation criterion and searching the second time-series data store for log data that satisfy the correlation criterion.
23. A method as recited in claim 1 , wherein the performance measurements are stored in a first time-series data store in a first format, and the log data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format;
the method further comprising:
receiving a user-specified search query in a query language for searching the first and second time-series data stores, the user-specified search query containing the correlation criterion, wherein the correlation criterion comprises a user-specified value or a user-specified range of values, for a user-specified field;
wherein said correlating further includes, in response to the user-specified search query, searching the first time-series data store for performance data that satisfy the correlation criterion and searching the second time-series data store for log data that satisfy the correlation criterion.
24. A method as recited in claim 1 , further comprising:
acquiring structure data indicative of structure characteristics of the IT environment;
storing the acquired structure data indicative of structure characteristics of the IT environment; and
correlating a performance characteristic of the IT environment with a structure characteristic of the IT environment, based on the stored performance measurements and stored structure data.
25. A method as recited in claim 1 , further comprising:
acquiring structure data indicative of structure characteristics of the IT environment, wherein the structure data is derived from the log data from the IT environment;
storing the acquired structure data indicative of structure characteristics of the IT environment; and
correlating a performance characteristic of the IT environment with a structure characteristic of the IT environment, based on the stored performance measurements and stored structure data.
26. A method as recited in claim 1 , wherein the at least one performance metric comprises a performance metric for at least one hardware or software resource of a computer system.
27. A method as recited in claim 1 , wherein the at least one performance metric comprises a performance metric for at least one virtual machine, virtual machine host, or virtual machine cluster.
28. A method as recited in claim 1 , wherein the at least one performance metric relates to CPU, memory, input/output rate, a write amount, a read amount, a request amount, or a command amount.
29. One or more computer storage media having computer-executable instructions embodied thereon that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:
acquiring, by a computer system, performance measurements for at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment;
acquiring, by the computer system, log data representing activity of at least one hardware or software component of the IT environment;
comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value;
correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation criterion; and
causing display, via a graphical user interface, of an indication of the correlation of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data.
30. A system comprising:
a processor; and
computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, configure the computing system to:
acquiring, by a computer system, performance measurements for at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment;
acquiring, by the computer system, log data representing activity of at least one hardware or software component of the IT environment;
comparing, by the computer system, the performance measurements to a threshold value to determine a portion of the performance measurements having a specified relationship to the threshold value;
correlating, by the computer system, a portion of the log data with at least one of the performance measurements in the portion of the performance measurements having the specified relationship to the threshold value, the correlation based on a correlation; and
causing display, via a graphical user interface, of an indication of the correlation of the portion of the log data and an indication of the at least one of the performance measurements having the specified relationship to the threshold value to indicate performance of the at least one hardware or software component of the IT environment for the performance metric in association with the correlated log data.