Methods and systems to sample event messages

1. In a process for sampling and querying event messages generated by various sources of event messages of a distributed computing system, the improvement comprising:

temporarily storing each event message in a storage queue;

displaying on a display screen of a computer system a graphical user interface that enables a user to set an event message policy for sampling a fraction of the event messages and storing copies of the fraction of sampled event messages in a sample log file;

for each event message in the storage queue,

storing the event message in an event-log file, and

storing a copy of the event message in the sample log file when the event message satisfies the event message policy set by the user; and

displaying event types of the event messages stored in the sample log file in the graphical user interface, thereby enabling a user to query the event messages stored in the sample log file to determine if a specific type of event message has been generated.

2. The process of claim 1 , wherein the graphical user interface that enables the user to set the event message policy comprises enables the user to set a sample rate that represents a fraction of event messages that satisfy the event message policy to be stored in the sample log file.

3. The process of claim 1 , wherein the graphical user interface that enables the user to set the event message policy comprises enables the user to set a plurality of sample rates, each sample rate corresponding to a different event type and representing a fraction of event messages having the same event type to be stored in the sample log file.

4. The process of claim 1 , wherein storing the copy of the event message in the sample log file comprises:

generating a random number;

calculating a threshold based on the event message policy that represents a fraction of event messages to be stored in the sample log file; and

when the random number is less than or equal to the threshold, storing the copy of the event message in the sample log file.

5. The process of claim 1 , wherein storing the copy of the event message in the sample log file comprises:

generating a random number; determining an event type of each event message using event-type analysis;

displaying in the graphical user interface event types of the event messages and fields that enable a user to set a sample rate for each event type, each sample rate representing a fraction of event messages of the event type to be stored in the sample log file;

calculating a threshold based on the sample rate; and when the random number is less than or equal to the threshold, storing the copy of the event message in the sample log file.

6. A computer system that samples and queries event messages generated by one or more sources of event messages of a distributed computing system, the computer system comprising:

one or more processors;

one or more data-storage devices; and

machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system performs the operations comprising:

temporarily storing the event messages in a storage queue;

displaying on a display screen of the computer system a graphical user interface that enables a user to set an event message policy for sampling a fraction of the event messages and storing copies of the fraction of sampled event messages in a sample log file;

for each event message in the storage queue,

storing the event message in an event-log file, and

storing a copy of the event message in the sample log file when the event message satisfies the event message policy set by the user; and

displaying event types of the event messages stored in the sample log file in a graphical user interface that enables a user to query the event messages stored in the sample log file.

7. The computer system of claim 6 , wherein the graphical user interface that enables the user to set the event message policy comprises enables the user to set a sample rate that represents a fraction of event messages that satisfy the event message policy to be stored in the sample log file.

8. The computer system of claim 6 , wherein the graphical user interface that enables the user to set the event message policy comprises enables the user to set a plurality of sample rates, each sample rate corresponding to a different event type and representing a fraction of event messages having the same event type to be stored in the sample log file.

9. The computer system of claim 6 , wherein storing the copy of the event message in the sample log file comprises:

generating a random number;

calculating a threshold based on the event message policy that represents a fraction of event messages to be stored in the sample log file; and

when the random number is less than or equal to the threshold, storing the copy of the event message in the sample log file.

10. The computer system of claim 6 , wherein storing the copy of the event message in the sample log file comprises:

generating a random number;

determining an event type of each event message using event-type analysis; displaying in the graphical user interface event types of the event messages and fields that enable a user to set a sample rate for each event type, each sample rate representing a fraction of event messages of the event type to be stored in the sample log file;

calculating a threshold based on the sample rate; and

when the random number is less than or equal to the threshold, storing the copy of the event message in the sample log file.

11. A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system that performs the operations comprising:

temporarily storing event messages generated by one or more sources of event messages of a distributed computing system in a storage queue;

displaying on a display screen of the computer system a graphical user interface that enables a user to set an event message policy for sampling a fraction of the event messages and storing copies of the fraction of sampled event messages in a sample log file;

for each event message in the storage queue,

storing the event message in an event-log file, and

storing a copy of the event message in the sample log file when the event message satisfies the event message policy set by the user; and

displaying event types of the event messages stored in the sample log file in a graphical user interface that enables a user to query the event messages stored in the sample log file.

12. The medium of claim 11 , wherein the graphical user interface that enables the user to set the event message policy comprises enables the user to set a sample rate that represents a fraction of event messages that satisfy the event message policy to be stored in the sample log file.

13. The medium of claim 11 , wherein the graphical user interface that enables the user to set the event message policy comprises enables the user to set a plurality of sample rates, each sample rate corresponding to a different event type and representing a fraction of event messages having the same event type to be stored in the sample log file.

14. The medium of claim 11 , wherein storing the copy of the event message in the sample log file comprises:

generating a random number;

calculating a threshold based on the event message policy that represents a fraction of event messages to be stored in the sample log file; and

when the random number is less than or equal to the threshold, storing the copy of the event message hi the sample log file.

15. The medium of claim 11 , wherein storing the copy of the event message in the sample log file comprises:

generating a random number;

determining an event type of each event message using event-type analysis;

displaying in the graphical user interface event types of the event messages and fields that enable a user to set a sample rate for each event type, each sample rate representing a fraction of event messages of the event type to be stored in the sample log file;

calculating a threshold based on the sample rate; and

when the random number is less than or equal to the threshold, storing the copy of the event message in the sample log file.